Summary
Square Squash through commit e73f280 contains an unsafe YAML deserialization vulnerability in its symbolication workflow. An unauthenticated attacker may store crafted YAML through the symbolication API, and later processing of a related occurrence could deserialize attacker-controlled Ruby objects and potentially execute code.
Square Squash through commit e73f280 contains an unsafe YAML deserialization vulnerability in its symbolication workflow. An unauthenticated attacker may store crafted YAML through the symbolication API, and later processing of a related occurrence could deserialize attacker-controlled Ruby objects and potentially execute code.
Affected context
The issue may affect Square Squash deployments using the symbolication endpoint and the workflow that processes occurrences associated with stored symbolication UUIDs. Risk arises when attacker-controlled YAML is retained and later passed to YAML.load through SafeYAML operating in an unsafe mode, before the data is constrained to a safe, expected representation.
The issue may affect Square Squash deployments using the symbolication endpoint and the workflow that processes occurrences associated with stored symbolication UUIDs. Risk arises when attacker-controlled YAML is retained and later passed to YAML.load through SafeYAML operating in an unsafe mode, before the data is constrained to a safe, expected representation.
Exploit preconditions
- Attack surface: The
/api/1.0/symbolicationHTTP endpoint - Required access: The ability to submit requests to the endpoint; authentication may not be required
- Trigger point: Symbolication of an occurrence that references the attacker-controlled symbolication UUID
- Why exploitation is possible: Stored YAML values are later deserialized with an unsafe loader capable of instantiating arbitrary Ruby objects
- Attack surface: The
/api/1.0/symbolicationHTTP endpoint - Required access: The ability to submit requests to the endpoint; authentication may not be required
- Trigger point: Symbolication of an occurrence that references the attacker-controlled symbolication UUID
- Why exploitation is possible: Stored YAML values are later deserialized with an unsafe loader capable of instantiating arbitrary Ruby objects
Why this happens
The vulnerability results from treating attacker-controlled YAML as a trusted serialized object format. Passing that data to YAML.load with SafeYAML configured for unsafe behavior permits arbitrary Ruby object deserialization rather than restricting input to simple data types. This maps to CWE-502: Deserialization of Untrusted Data, because serialized input can influence object construction and associated runtime behavior.
The vulnerability results from treating attacker-controlled YAML as a trusted serialized object format. Passing that data to YAML.load with SafeYAML configured for unsafe behavior permits arbitrary Ruby object deserialization rather than restricting input to simple data types. This maps to CWE-502: Deserialization of Untrusted Data, because serialized input can influence object construction and associated runtime behavior.
Potential impact
- Arbitrary Ruby code execution in the application process may occur
- Application data or processing workflows could be compromised
- Attackers could alter symbolication-related results or stored records
- Credentials and other secrets accessible to the application may be exposed
- The application environment could be used for further unauthorized access
- Arbitrary Ruby code execution in the application process may occur
- Application data or processing workflows could be compromised
- Attackers could alter symbolication-related results or stored records
- Credentials and other secrets accessible to the application may be exposed
- The application environment could be used for further unauthorized access
General mitigation guidance
Mitigation generally focuses on removing executable deserialization behavior and reducing trust in data submitted through symbolication APIs.
Common defensive patterns include:
- Using safe YAML parsing that permits only required primitive data types
- Replacing serialized object transport with explicit, schema-defined records
- Validating and normalizing submitted values before storage and again before use
- Treating stored symbolication data as untrusted even after persistence
- Restricting application permissions, filesystem access, and secret visibility
- Applying network and process isolation to limit consequences if application code is compromised
Mitigation generally focuses on removing executable deserialization behavior and reducing trust in data submitted through symbolication APIs.
Common defensive patterns include:
- Using safe YAML parsing that permits only required primitive data types
- Replacing serialized object transport with explicit, schema-defined records
- Validating and normalizing submitted values before storage and again before use
- Treating stored symbolication data as untrusted even after persistence
- Restricting application permissions, filesystem access, and secret visibility
- Applying network and process isolation to limit consequences if application code is compromised
How teams detect issues like this
High-level detection approaches may include:
- Static analysis rules identifying
YAML.load, unsafe SafeYAML modes, and equivalent dynamic deserialization paths - Code review checks for user-controlled values that are persisted and later deserialized
- Runtime monitoring for unexpected Ruby object creation, process execution, or outbound connections during symbolication
- API policy checks requiring authentication, validation, and bounded input formats for symbolication submissions
- Logging and alerting on unusual symbolication UUID creation and follow-up processing patterns
Automated code review and dependency-analysis tools may help identify unsafe deserialization patterns during development.
High-level detection approaches may include:
- Static analysis rules identifying
YAML.load, unsafe SafeYAML modes, and equivalent dynamic deserialization paths - Code review checks for user-controlled values that are persisted and later deserialized
- Runtime monitoring for unexpected Ruby object creation, process execution, or outbound connections during symbolication
- API policy checks requiring authentication, validation, and bounded input formats for symbolication submissions
- Logging and alerting on unusual symbolication UUID creation and follow-up processing patterns
Automated code review and dependency-analysis tools may help identify unsafe deserialization patterns during development.
