Get the latest tech news
Marshal madness: A brief history of Ruby deserialization exploits
This post traces the decade-long evolution of Ruby Marshal deserialization exploits, demonstrating how security researchers have repeatedly bypassed patches and why fundamental changes to the Ruby ecosystem are needed rather than continued patch-and-hope approaches.
Documenting the evolution of exploitation techniques serves a crucial purpose in security engineering: it helps us understand not just individual vulnerabilities but the systemic patterns that resist conventional fixes. Before running off to find earlier examples, consider the point I’m trying to make here: that there is a direct link between Hailey’s issue and modern Ruby deserialization exploit development. Then, as mentioned at the beginning of the story, Luke Jahnke enters back onto the scene on November 24, 2024, with “ Ruby 3.4 Universal RCE Deserialization Gadget Chain,” and again on December 3 with “ Gem::SafeMarshal escape.” Both of these techniques were eventually patched.
Or read this on Hacker News