Another Ruby Marshal Chain: RCE in Rails

A novel Ruby on Rails deserialisation gadget chain: two native ActiveSupport gadgets run code via Marshal.load on a patched framework — no ERB.

Scripta