Savon::Model Gem Vulnerability: Ruby Code Injection Risk
An early warning has been issued regarding a vulnerability in the Savon::Model gem, which reportedly allows an attacker to inject Ruby code by controlling WSDL operation names. This affects applications using Savon gem versions prior to 2.17.2.
What happened
The Savon::Model gem generates SOAP operation methods by interpolating operation names into Ruby source passed to `module_eval`. It appears that an attacker who can control the operation names of a WSDL can inject Ruby code that executes in the application process. This vulnerability specifically affects the `.all_operations` class method provided by Savon::Model.
The vulnerability is under investigation, but the recommended action is to upgrade to Savon 2.17.2 or later. Additionally, it is advised to avoid using `.all_operations` for untrusted WSDL documents to mitigate potential risks.
For more detailed information, consult the primary sources linked in the summary. The exact scope and impact are still being assessed, so it is crucial to stay updated with the latest advisories and patches.
How 0Day mitigates this
savon is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.