[ruby]: add YAML/Psych/Plist unsafe deserialization sinks

[am0o0]

Query PR

github/codeql#12301
github/codeql#13431

Language

Ruby

CVE(s) ID list

• CVE-2022-32224
• CVE-2021-33575 cause by dangerous Plist.parse_xml sink

CWE

CWE-502: Deserialization of Untrusted Data

Report

1. Deserialization of Untrusted Data from a yaml serialized document
2. with user controllable inputs such as yaml strings or yaml files, it is possible to execute code.
3. I add some additional sinks and taint tracking steps of paramiko library.
4. with Psych >= 4.0.0 Psych.load is secure by default, so I think the current codeql std lib for ruby should change it to. There are many other sinks that developers can use it in their applications, so I put my time to find all insecure ways/methods that currently are dangerous.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

A series of Blog posts will be forthcoming soon!

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[am0o0]

Is it possible to first merge this pull request before Query review please?

[ghsecuritylab]

Your submission is now in status Test run.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[xcorail]

Created Hackerone report 2123679 for bounty 508103 : [732] [ruby]: add YAML/Psych/Plist unsafe deserialization sinks

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed