postmodernJust released bundler-audit 0.9.3, which officially adds support for Ruby 3.4, 3.5, 4.0, and Bundler 4.x.
https://github.com/rubysec/bundler-audit/releases/tag/v0.9.3
https://github.com/rubysec/bundler-audit#readme
FastRuby.io💣 Is your #Ruby app vulnerable to known CVEs? Is it safe in production? Is it ready for a #SOC2 audit?
If you don’t know, you need a security audit. Find out how many vulnerabilities are present in your code and dependencies. Let's talk!
PSA: supply chain attacks (aka forking popular gems, changing the name slightly, and adding malicious code) are starting to show up on https://rubygems.org more often. Be cautious when adding a new gem to your project. Check who the author is, check the GitHub repository, look at the commit history, etc.
https://socket.dev/blog/malicious-ruby-gems-exfiltrate-telegram-tokens-and-messages-following-vietnam-ban
postmodernThe so-called "supply chain attacks" (really just typosquatting) are starting to show up on https://rubygems.org. Luckily for the Ruby community all of the good gem names have already been taken🥁 /s.
https://socket.dev/blog/malicious-ruby-gems-exfiltrate-telegram-tokens-and-messages-following-vietnam-ban
Ruby's Bundler dependency manager now has checksum verification built-in to prevent cache poisoning attacks.
https://mensfeld.pl/2025/01/the-silent-guardian-why-bundler-checksums-are-a-game-changer-for-your-applications/
Someone found a Gem::SafeMarshal escape in Ruby! (Also, this blog is 🔥 for Ruby security research.)
https://nastystereo.com/security/ruby-safe-marshal-escape.html
#ruby #rubysec #securityresearch #vulnerabilityresearch #deserializationvulnerability
Note: before all of the script kiddies get their hopes up and think they can pwnxorize every Rails app, deserialization vulnerabilities in Ruby are actually quite rare these days due to
#rubysec #deserialization
Marshal.load almost never being used in the wild and YAML.load has been aliased to YAML.safe_load for some time now.#rubysec #deserialization
Ruby 3.4 Universal RCE Deserialization Gadget Chain
https://nastystereo.com/security/ruby-3.4-deserialization.html
Catching up on ActiveRecord's new (circa 2023) encrypted column support (aka Encryption at Rest).
https://www.youtube.com/watch?v=IR2demNrMwQ
#rubysec #rails #encryption #encryptedatrest #encryptedstorage
Kylie Stradley - Everything we learned while Implementing ActiveRecord::Encryption - Rails World
TIL using the <math> tag for XSS with HTML5 parsers.
https://www.youtube.com/watch?v=USPLEASZ0Dc
