Ruby 4.0 Universal RCE Deserialization Gadget Chain

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://elttam.com/blog/ruby-4-0-universal-rce-deserialization-gadget-chain
• Blog Title: Ruby 4.0 Universal RCE Deserialization Gadget Chain
• Suggested Section: Pentesting Web > Deserialization > Ruby Marshal Deserialization Gadget Chains

🎯 Content Summary

Overview

The post presents a universal Ruby deserialization gadget chain that turns one attacker-controlled Marshal.load operation into arbitrary Ruby code execution and operating-system command execution. The author demonstrated it on Ruby 4.0.6 and states that it works unchanged on Ruby 3.3 through 4.0.6. It requires no application-specific classes, third-party gems, or preexisting attacker files: the chain uses RubyGems components...

🔧 Technical Details

Autoload-assisted gadget expansion: Reference an autoloaded constant early in a serialized graph to force the deserializer to load additional library files. In Ruby, resolving Gem::SpecFetcher during Marshal.load exposes RubyGems classes required by later gadgets, allowing a chain to function in a minimal process without application-specific dependencies.

Hash-key deserialization trigger: Place an attacker-configured object with a side-effectful hash implementation in a serialized Hash key position. Reconstructing the hash automatically invokes hash. Here, a Gem::StubSpecification with attacker-controlled @loaded_from reaches Gem::Specification.load. This general technique is comparable to Java deserialization chains that exploit HashMap.readObject invoking hashCode.

File-to-eval sink: Identif...

🤖 Agent Actions

Updated src/pentesting-web/deserialization/README.md.

Added concise coverage of:

• Ruby 3.3–4.0 RubyGems Marshal gadget chain.
• Autoload expansion and forged Time trigger.
• to_str → to_s bridging and failure-tolerant file writes.
• Hash-key-triggered Gem::Specification.load evaluation.
• Deflated payload preparation and clean return values.
• Marshal byte-stream surgery constraints.
• Preconditions, privilege scope, and detection indicators.
• Numbered citation to the original elttam research.

Validation passed with git diff --check and custom Markdown/reference checks. mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://elttam.com/blog/ruby-4-0-universal-rce-deserialization-gadget-chain

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > Deserialization > Ruby Marshal Deserialization Gadget Chains".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0