YAML f7u12

YAML f7u12 | Tenderlovemaking

YAML f7u12

Our attacker knows that this class is defined in the system. Using YAML, along with Psych’s object deserialization, they can inject any object in to the system they choose. So how can they use this object? Let’s take a look at the YAML payload for exploiting this code, then talk about how it works:

Full article: http://tenderlovemaking.com/2013/02/06/yaml-f7u12.html

Tweets

@yshahin_dev » 27 Feb '13, 9am
Ruby YAML exploid clarification - good read - YAML f7u12 | Tenderlovemaking [link] [link]
@netwillnet » 25 Feb '13, 2pm
YAMLはmarshallみたいなもので、大抵のものを表せるのでJSONと同じような感覚でいたらいけない。外部のYAMLをloadするようなことはしちゃだめ / “YAML f7u12 | Tenderlovemaking” [link]
@rstankov » 21 Feb '13, 6pm
RT @baruco: YAML f7u12 (About the recent exploit in Rails) from @tenderlove [link]
@adamtait » 19 Feb '13, 4pm
a review of recent major Rails exploit through defining ruby code in YAML [link]
@psionides » 18 Feb '13, 8am
YAML F7U12 - @tenderlove's analysis of the recent YAML-related vulnerabilities [link]
@sato_ryu » 18 Feb '13, 2am
YAMLによる攻撃の仕方あれこれ。任意のコードが実行できるもんだねぇ。[link]
@fphilipe » 16 Feb '13, 4pm
YAML F7U12 – Tenderlove Making [link]
@pawel_lasek » 16 Feb '13, 2pm
RT @fogus: It's ok to read a post about YAML minus invectives and with thoughtful discussion about trade offs (via @samumbach) [link]
@fogus » 16 Feb '13, 2pm
It's ok to read a post about YAML minus invectives and with thoughtful discussion about trade offs (via @samumbach) [link]
@colmarius » 16 Feb '13, 11am
Interesting aspect about security in Ruby and Rails applications. YAML.safe_load [link]
@pcreux » 15 Feb '13, 12pm
@yoavweiss You might enjoy this: [link] (rails sec issue explained)
@siuying » 15 Feb '13, 9am
YAML F7U12 [link] “Think of YAML as a human readable Marshal.”
@derfarg » 15 Feb '13, 3am
RT @rubyalert: YAML f7u12 | Tenderlovemaking: [link]
@rubyblackbelt » 14 Feb '13, 10pm
YAML attack vectors. [link]
@spicy_sake » 14 Feb '13, 8pm
RT @matteocollina: YAML f7u12 [link]
@rochefort8 » 14 Feb '13, 4pm
最近のyamlの脆弱性について。誰か3行で。 / “YAML f7u12 | Tenderlovemaking” [link]
@fvollero » 14 Feb '13, 3pm
YAML f7u12 [link] thanks for this @tenderlove
@TDKPS » 14 Feb '13, 2pm
RT @_emboss_: A great, calm and precise write-up by @tenderlove covering the recent YAML exploits. [link]
@_emboss_ » 14 Feb '13, 1pm
A great, calm and precise write-up by @tenderlove covering the recent YAML exploits. [link]
@matteocollina » 14 Feb '13, 10am
YAML f7u12 [link]
@nathany » 14 Feb '13, 7am
YAML security exploits, @tenderlove covers the issues. [link] #rubylang
@danpilone » 14 Feb '13, 2am
RT @e84news: Best writeup I’ve seen from @tenderlove about the underlying issue(s) triggering this rash of Rails security fixes. [link]
@e84news » 14 Feb '13, 2am
Best writeup I’ve seen from @tenderlove about the underlying issue(s) triggering this rash of Rails security fixes. [link]
@rexfeng » 13 Feb '13, 10pm
YAML FFFFFFFUUUUUUUUUUUU by @tenderlove [link] great read about YAML.safe_load #rails
@PerlSawyer » 13 Feb '13, 4pm
RT @sartak: Excellent overview of all the recent security issues in Rails (including sample exploit payloads). [link]
@sartak » 13 Feb '13, 3pm
Excellent overview of all the recent security issues in Rails (including sample exploit payloads). [link]
@iNem0o » 13 Feb '13, 2pm
RT @rgaidot: "YAML was used as the attack vector to execute arbitrary code in a Rails process" [link]
@rgaidot » 13 Feb '13, 2pm
"YAML was used as the attack vector to execute arbitrary code in a Rails process" [link]
@stef » 13 Feb '13, 11am
RT @apeacox: Tenderlove on Rails security exploits [link] via @prismatic
@apohorecki » 13 Feb '13, 10am
"Tenderlove on Rails security exploits" [link] - recommended via @Prismatic
@brianloveswords » 13 Feb '13, 4am
Since it's too late to put the genie back in the bottle and make `load` safe, safe_load is definitely the way to go: [link]
@localshred » 12 Feb '13, 8pm
I <3 @tenderlove. Such a great post explaining CRAZY yaml vulnerabilities. My fav is the symbol DoS attack [link]
@jakuboboza » 12 Feb '13, 8pm
[link] good read
@MarkHolton » 12 Feb '13, 7pm
Awesome post by @tenderlove explaining recent Rails exploits: YAML f7u12 | Tenderlovemaking [link]
@justinko » 12 Feb '13, 5pm
RT @alexrothenberg: if you haven't yet you should read @tenderlove's explanation of how yaml has been exploited recently [link]
@jrheard » 12 Feb '13, 4pm
Tenderlove on Rails security exploits [link] via @prismatic
@alexrothenberg » 12 Feb '13, 4pm
if you haven't yet you should read @tenderlove's explanation of how yaml has been exploited recently [link]
@phopkins » 12 Feb '13, 3pm
It's probably too reductive and snarky to call this "proof that Rails as too much magic for its own good," but yeah: [link]
@parkr » 12 Feb '13, 2pm
RT @joanwolk: Want a really readable article about what the recent YAML/Rails issues have been about? Check out [link]
@timbunce » 12 Feb '13, 2pm
Very clear summary. RT “BTW, if you missed @tenderlove’s post on the YAML stuff, you’re missing out. [link]” #security
@joanwolk » 12 Feb '13, 2pm
Want a really readable article about what the recent YAML/Rails issues have been about? Check out [link]
@jasonmulligan » 12 Feb '13, 1pm
@feylya have you seen: [link] … this meta programming is totally silly; no checks / bounds by default?
@trptcolin » 12 Feb '13, 1pm
RT @benmmurphy: Really good blog post by @tenderlove on YAML security. [link] #ruby #rails
@buffym » 12 Feb '13, 1pm
Really great writeup by @tenderlove on the YAML exploits. [link] Spells out the issues thoughtfully.
@benmmurphy » 12 Feb '13, 1pm
Really good blog post by @tenderlove on YAML security. [link] #ruby #rails
@m3nd3s » 12 Feb '13, 12pm
YAML f7u12 | Tenderlovemaking [link]
@cdamian » 12 Feb '13, 11am
RT @zimpenfish: Let me paraphrase: "YAML is a disastrous mess of idiocy and Ruby is its dumbass cousin." [link]
@MurielSalvan » 12 Feb '13, 11am
YAML f7u12 bu @tenderlove - Great insight in understanding common #vulnerabilities (not #Yaml specific) [link] #ruby #security
@zimpenfish » 12 Feb '13, 11am
Let me paraphrase: "YAML is a disastrous mess of idiocy and Ruby is its dumbass cousin." [link]
@a_z_e_t » 12 Feb '13, 10am
this is nice. YAML object injection into ruby code - [link] via @ch2500