RubyGems.org

rubygems-pwn

0.1.0

A Proof of Concept (PoC) exploit for an trivial Security vulnerability in how RubyGems converts YAML-dumped gemspecs, back into Ruby code, when installing RubyGems. This ties into the larger design mistake, of storing installed gemspecs as Ruby code; since evaling Ruby code was faster than loading YAML gemspecs. When handling data, it is safer to store it in a static format (YAML, XML, CSV), instead of executable code.

installgem install rubygems-pwn -v 0.1.0
Authors

Postmodern

2,005 total downloads 954 for this version
Owners

66f5d5b64b951b3eeb8b6c34fcb69237

Gemfile
gem 'rubygems-pwn', '~> 0.1.0'
Versions
  1. 0.1.1 August 26, 2011 (5.5 KB)
  2. 0.1.0 August 25, 2011 (5 KB)