A newly disclosed universal deserialization gadget chain demonstrates that a single unsafe Marshal.load operation can lead to remote command execution on Ruby 4.0.6
The chain reportedly also works unchanged on Ruby versions as far back as 3.3, renewing concerns that Ruby’s native serialization mechanism remains a high-risk attack surface when exposed to untrusted data
The research builds on more than a decade of Ruby deserialization exploitation, including prior chains targeting Ruby on Rails, YAML.load, RubyGems, and the standard library
New Ruby RCE Gadget Chain Turns Unsafe Marshal.load
Unlike older proofs-of-concept that stopped working after changes in Ruby 3.4, the latest chain uses a new combination of RubyGems and core language features to execute code without requiring application-specific dependencies or pre-existing files on the target host
At a high level, the attack abuses Ruby’s object reconstruction process. Marshal.load restores serialized objects and may trigger class loading, method calls, and object-state restoration during deserialization
The new chain reportedly begins by referencing Gem::SpecFetcher, causing RubyGems autoloading to make additional classes available in an otherwise minimal Ruby process. The attack then combines two capabilities: retrieving attacker-controlled content and evaluating it as Ruby code
A surviving RubyGems gadget can fetch compressed content from an attacker-controlled HTTPS server and write the inflated result to a predictable writable location, such as /tmp
A separate Gem::StubSpecification object causes RubyGems to invoke Gem::Specification.load against that written file. Gem::Specification.load reads the target file and evaluates its contents using Ruby’s eval functionality
Consequently, if an attacker controls both the downloaded file and its destination path, the deserialization flow can execute arbitrary Ruby statements under the privileges of the affected application
Two properties make this chain particularly notable. First, it uses Time deserialization to trigger the download action while suppressing an expected exception
The process reportedly routes a crafted value through a conversion path that eventually calls attacker-controlled object methods. Second, it uses standard hash behavior as the execution trigger
When Ruby rebuilds a Hash during Marshal.load, it computes the hash value of restored keys. A crafted Gem::StubSpecification used as a key can therefore invoke its hash method, ultimately reaching the file-loading and evaluation path
These triggers are more difficult to eliminate than narrowly scoped RubyGems gadgets. Previous RubyGems fixes blocked known chains by adding type checks and removing attacker-controlled executable paths
However, Luke Jahnke stated that core behaviors such as hash-key processing and tolerant Time restoration cannot be removed without potentially breaking expected language semantics. The practical impact is severe wherever an attacker can supply or influence Ruby Marshal data
A vulnerable service may require only a reachable attacker-controlled HTTPS host and access to a writable directory; it does not necessarily need third-party gems, prior files, or application-specific gadget classes
Organizations should treat Marshal.load on untrusted input as equivalent to direct code execution
Developers should remove it from network-facing and user-controlled data flows, including cookies, cache entries, background-job payloads, message queues, uploaded files, and database fields that could be modified by less-trusted systems
Where serialized data is required, teams should migrate to data-only formats such as JSON, with strict schemas and explicit type validation
Existing Ruby applications should be audited for Marshal.load, Marshal.restore, YAML.load, and related unsafe deserialization paths, while incident responders should watch for unusual outbound HTTPS requests, unexpected writes beneath temporary directories, and Ruby processes spawning commands
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
