r/netsec 6d ago

Ruby Marshal Kick-off Gadgets - elttam

https://www.elttam.com/blog/ruby-marshal-kick-off-gadgets
9 Upvotes

1 comment sorted by

1

u/Just_Worldliness_714 2d ago

The interesting part is that these aren't custom deserialization hooks like marshal_load - hash, eql?, <=>, to_str, to_s, and respond_to? are ordinary methods every Ruby object already has, invoked automatically the moment the deserialized object gets compared, hashed, or coerced anywhere downstream. That's what makes it hard to harden away: you'd have to audit every place a deserialized object might end up in a Hash key, a case/when, or a string interpolation, not just look for classes that opt into deserialization callbacks.