A newly disclosed universal deserialization gadget chain shows how a single unsafe Marshal.load operation can reportedly produce remote command execution in Ruby 4.0.6, underscoring the persistent danger of exposing Ruby’s native serialization mechanism to attacker-controlled data. According to research published by elttam, the chain also works unchanged on Ruby versions as far back as 3.3. […]
The post Ruby 4.0 Marshal.load RCE Gadget Chain Exposes Critical Deserialization Risk appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.