Critical Ruby Worker Deserialization Flaw Opens Door to Complete System Takeover

A critical remote code execution (RCE) flaw has emerged in RubitMQ job workers, rooted in unsafe JSON deserialization.

Security researcher NullSecurityX uncovered this issue, which lets attackers turn innocent-looking JSON data into dangerous executable code.

Unlike memory corruption bugs, this stems from flawed design assumptions in Ruby background systems that blindly trust processed data. The vulnerability, tracked as CVE-2024-XXXX, carries a CVSS score of 9.8, marking it as critical.

Systems running vulnerable RubitMQ setups face full infrastructure compromise risks, including data theft and lateral network movement.

NullSecurityX demonstrated the exploit on platforms like Medium, showing how attackers bridge data and code execution gaps.

This affects Ruby applications using the Oj gem for fast JSON handling, common in job queues and background workers.

Developers often pick Oj for speed, but its object deserialization features create hidden dangers.

When a payload hits the worker, Oj.load doesn’t just unpack data it rebuilds full Ruby objects from the JSON, including custom classes from the app code. This opens doors to object injection attacks.

Technical Analysis of the Flaw

At its heart, the bug exploits Oj.load’s support for directives like ^o, which trigger class instantiation. In RubitMQ’s architecture, workers process jobs via capability-based checks.

They verify if an object has a run_find method before dispatching it, assuming this proves safe authorization.

Attackers craft JSON payloads that instantiate the app’s Node utility class, which includes a run_find method powered by Open3.capture3 for shell command execution.

Here’s the CVE breakdown:

The exploit gets deterministic by abusing the Unix find command’s -exec flag. A malicious payload injects arguments that chain find to run arbitrary shell commands, all under the worker’s privileges.

This bypasses typical controls like input validation or sandboxing. NullSecurityX’s proof-of-concept shows commands executing reliably, leading to data exfiltration, service crashes, or pivots to other systems. No memory tricks needed just clever JSON engineering.

Affected Products and Mitigation Steps

RubitMQ job workers bear the brunt, but the Oj gem’s default config amplifies risks across Ruby apps.

Here’s a summary:

To fix this, upgrade RubitMQ to patched versions if available, or switch Oj.load to safer modes like:json mode that disables object creation.

Validate payloads strictly, run workers in isolated containers, and audit dynamic dispatch logic. Enable Ruby’s safe YAML-like restrictions for JSON too. CISA and similar bodies may issue alerts soon.

This flaw highlights why “safe” formats like JSON need scrutiny in untrusted inputs. Background workers often run with elevated access, making deserialization a prime RCE vector. Teams using Ruby queues should scan code now.

Follow us on Google News, LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google