postmodernPSA: supply chain attacks (aka forking popular gems, changing the name slightly, and adding malicious code) are starting to show up on https://rubygems.org more often. Be cautious when adding a new gem to your project. Check who the author is, check the GitHub repository, look at the commit history, etc.
https://socket.dev/blog/malicious-ruby-gems-exfiltrate-telegram-tokens-and-messages-following-vietnam-ban
postmodernThe so-called "supply chain attacks" (really just typosquatting) are starting to show up on https://rubygems.org. Luckily for the Ruby community all of the good gem names have already been takenš„ /s.
https://socket.dev/blog/malicious-ruby-gems-exfiltrate-telegram-tokens-and-messages-following-vietnam-ban
Ruby's Bundler dependency manager now has checksum verification built-in to prevent cache poisoning attacks.
https://mensfeld.pl/2025/01/the-silent-guardian-why-bundler-checksums-are-a-game-changer-for-your-applications/
Someone found a Gem::SafeMarshal escape in Ruby! (Also, this blog is š„ for Ruby security research.)
https://nastystereo.com/security/ruby-safe-marshal-escape.html
#ruby #rubysec #securityresearch #vulnerabilityresearch #deserializationvulnerability
Note: before all of the script kiddies get their hopes up and think they can pwnxorize every Rails app, deserialization vulnerabilities in Ruby are actually quite rare these days due to
#rubysec #deserialization
Marshal.load almost never being used in the wild and YAML.load has been aliased to YAML.safe_load for some time now.#rubysec #deserialization
Ruby 3.4 Universal RCE Deserialization Gadget Chain
https://nastystereo.com/security/ruby-3.4-deserialization.html
Catching up on ActiveRecord's new (circa 2023) encrypted column support (aka Encryption at Rest).
https://www.youtube.com/watch?v=IR2demNrMwQ
#rubysec #rails #encryption #encryptedatrest #encryptedstorage
Kylie Stradley - Everything we learned while Implementing ActiveRecord::Encryption - Rails World
TIL using the <math> tag for XSS with HTML5 parsers.
https://www.youtube.com/watch?v=USPLEASZ0Dc
Mike Dalessio - Rails::HTML5: the strange and remarkable three-year journey - Rails World 2023
If you want to know about the state of security in Ruby on Rails, checkout @gregmolnar's talk.
https://www.youtube.com/watch?v=Z3DgOix0rIg
Greg Molnar - The state of security in Rails 8 - Rails World 2024
Liking the new "maintainer" role for rubygem maintainers.
https://blog.rubygems.org/2024/11/07/maintainer-role.html