Dynamic Code Evaluation: Ruby YAML Deserialization

Unsafe deserialization of user supplied input can allow an attacker to inject arbitrary commands and gain unauthorized access to the system.

When accepting user input represented using a complex data format like YAML inside of XML, applications must carefully review the functionality exposed to end users. An applications ability to process user supplied data in such formats can be exploited by creating instances of classes defined in the application or assigning arbitrary values to the instance variables. This potentially exposes applications to code injection or SQL injection attacks.
An attacker can leverage this vulnerability to send specially crafted XML requests containing YAML ruby objects and execute arbitrary code based on those objects on the target application server. Furthermore, an attacker can use this opportunity to install rootkits, key loggers or other malware on the server.
Example 1: Initialize the ruby time object.
<?xml version="1.0" encoding="UTF-8"?>
<probe type="yaml">--- !ruby/object:Time {}</probe>

This payload will cause the XML parser to initialize the supplied Time object and assign it to the parameter 'probe'.
Incorrect parsing results in loading the supplied YAML objects and the invocation of the respective objects initialization routine. YAML can contain built-in ruby objects and assign it to a parameter named in the supplied XML element.