Project

General

Profile

Actions

Bug #7759

closed

Marshal.load is not documented to be dangerous

Added by Anonymous about 11 years ago. Updated about 11 years ago.

Status:
Closed
Assignee:
-
Target version:
ruby -v:
ruby 2.0.0dev (2013-01-07 trunk 38733) [x86_64-darwin12.2.1]
Backport:
[ruby-core:51765]

Description

=begin
Marshal.load is incredibly powerful, and also incredibly dangerous.

Unfortunately, many developers use it inappropriately and unmarshal user input. This can lead to a wide range of vulnerabilities, including remote code execution.

Marshal.load should be documented as dangerous and the documentation should also mention that it should only be used on trusted data.
=end


Related issues 1 (0 open1 closed)

Related to Ruby master - Bug #7780: Marshal & YAML should deserialize only basic types by default.Closedmatz (Yukihiro Matsumoto)Actions

Updated by kosaki (Motohiro KOSAKI) about 11 years ago

Marshal.load is incredibly powerful, and also incredibly dangerous.

Unfortunately, many developers use it inappropriately and unmarshal user input. This can lead to a wide range of vulnerabilities, including remote code execution.

Marshal.load should be documented as dangerous and the documentation should also mention that it should only be used on trusted data.

Makes sense. Can you please consider to write down the explanation?

Updated by nobu (Nobuyoshi Nakada) about 11 years ago

charliesome (Charlie Somerville) wrote:

Unfortunately, many developers use it inappropriately and unmarshal user input. This can lead to a wide range of vulnerabilities, including remote code execution.

Can't you elaborate it, probably, at ?

Marshal.load should be documented as dangerous and the documentation should also mention that it should only be used on trusted data.

I've thought it's a common sense, isn't it?

Updated by Anonymous about 11 years ago

I've thought it's a common sense, isn't it?

You would imagine so, however I have seen a lot of code that does unmarshal untrusted data.

I will send an example to . Please note that I do not consider this a vulnerability in Ruby. Marshal is dangerous by design. This is an education problem - we need to document the fact that it is dangerous.

Updated by ko1 (Koichi Sasada) about 11 years ago

(2013/01/31 8:59), charliesome (Charlie Somerville) wrote:

Unfortunately, many developers use it inappropriately and unmarshal user input. This can lead to a wide range of vulnerabilities, including remote code execution.

Could you explain attack scenario?

--
// SASADA Koichi at atdot dot net

Actions #5

Updated by Anonymous about 11 years ago

  • Status changed from Open to Closed
  • % Done changed from 0 to 100

This issue was solved with changeset r38999.
Charlie, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.


marshal.c: warn against using Marshal.load on untrusted data

  • marshal.c (marshal_load): Add documentation warning against using
    Marshal.load on untrusted data [Bug #7759] [ruby-core:51765]
Actions

Also available in: Atom PDF

Like0
Like0Like0Like0Like0Like0