Deserialization Flaw in Ruby Workers That Could Enable Full Compromise

A recent security vulnerability involving Remote Code Execution (RCE) has been identified in RubitMQ job workers due to unsafe JSON deserialization practices.

This vulnerability is not linked to memory corruption or undefined behavior but results from design-level trust assumptions concerning data processing in Ruby background systems. The flaw allows attackers to convert JSON inputs into executable commands, endangering the entire infrastructure.

The vulnerability originates from the use of Oj.load for handling job payloads. While JSON is generally considered a safe data-interchange format, the Oj library in Ruby includes object deserialization features capable of reconstructing functional objects.

The system allocates instances of application-defined classes upon encountering specific directives like ^o . This becomes critical when the application employs capability-based dynamic dispatch, checking if an object responds to a specific method before execution.

In this architecture, the system checks for a run_find method capability, assuming method availability as authorization. Attackers can exploit this by crafting JSON payloads to instantiate a Node utility class within the application code. This class contains a run_find method, executing system commands via Open3.capture3 .

RubitMQ : Job Worker (JSON Processor) - Update Required Ruby Oj Gem : Default Load Configuration - Configuration Change Required

By injecting arguments utilizing the Unix find command’s -exec flag, attackers can force the background worker to execute arbitrary shell commands. This deterministic exploitation path allows attackers to bypass security controls and execute commands with the background worker's privileges, potentially leading to data exfiltration, service disruption, or further network intrusion.

Based on reporting by GBHackers.