corpus.blog
42,390 blogs · 5,361,753 posts Claim your blog
Record · corpus.blog/posts/01a0fcb0-b475-70f0-8435-478f54bc7d89

New Method to Leverage Unsafe Reflection and Deserialisation to RCE on Rails - elttam

elttam.com · published 24 March 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at elttam.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
27
Words captured
3,030

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://ruby-doc.org/3.4.1/Kernel.html
ruby-doc.org
https://github.com/ruby/logger/commit/9321fab2ea3cb42584fe53bd79ccd3245da4792f
github.com
https://rubygems.org/gems/sqlite3
rubygems.org
https://rubygems.org/gems/activerecord
rubygems.org
https://rubygems.org/gems/activesupport
rubygems.org
https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection.rb
github.com
https://web.archive.org/web/20201030010411/https://blog.convisoappsec.com/en/exploiting-unsafe-reflection-in-rubyrails-applications/
web.archive.org
https://blog.presidentbeef.com/blog/2020/09/14/another-reason-to-avoid-constantize-in-rails/
blog.presidentbeef.com
https://nastystereo.com/security/rails-_json-juggling-attack.html
nastystereo.com
https://semgrep.dev/
semgrep.dev
https://github.com/ruby/rdoc/blob/master/lib/rdoc/ri/driver.rb
github.com
https://github.com/ruby/rdoc/blob/master/lib/rdoc/store.rb
github.com
https://github.com/sparklemotion/sqlite3-ruby/blob/main/lib/sqlite3/database.rb
github.com
https://www.sqlite.org/loadext.html
sqlite.org
https://github.com/ruby/logger/blob/master/lib/logger.rb
github.com
https://github.com/ruby/logger/blob/master/lib/logger/log_device.rb
github.com
https://github.com/rubygems/rubygems/blob/0782526c80b366bb7f42f21adc642d7672b3a8a3/lib/rubygems/config_file.rb
github.com
https://github.com/ruby/ruby/blob/c27f433d7c0ddb13501f7e19a0158da3aec1577c/ext/socket/lib/socket.rb
github.com
https://github.com/rails/rails/blob/main/activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb
github.com
https://github.com/rails/rails/blob/7845576df0fb68ff38f9ca754fca457a8e6758a3/activesupport/lib/active_support/configuration_file.rb
github.com
https://guides.rubyonrails.org/active_storage_overview.html
guides.rubyonrails.org
https://github.com/rack/rack
github.com
https://github.com/rack/rack/blob/main/lib/rack/multipart.rb
github.com
https://github.com/rack/rack/blob/main/lib/rack/multipart/parser.rb
github.com
https://github.com/rails/rails/blob/9f16995fb9556228ad88a3799b0e349ef6f6e0c7/activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb
github.com
https://github.com/rails/rails/blob/9f16995fb9556228ad88a3799b0e349ef6f6e0c7/activesupport/lib/active_support/deprecation/proxy_wrappers.rb
github.com
https://github.com/haileys/old-website/blob/master/posts/rails-3.2.10-remote-code-execution.md
github.com