Savon::Model Gem Vulnerability: Potential Ruby Code Injection
An early warning has been issued regarding a potential vulnerability in the Savon::Model gem, which may allow Ruby code injection through WSDL operation names. Users of Savon gem versions prior to 2.17.2 are reportedly affected.
What happened
The Savon::Model gem generates SOAP operation methods by interpolating operation names into Ruby source passed to `module_eval`. This mechanism appears to be exploitable if an attacker can control the operation names of a WSDL, allowing them to inject Ruby code that executes in the application process. This vulnerability specifically affects the `.all_operations` class method provided by Savon::Model.
To assess your exposure, check if your application uses the Savon gem and if it employs the `.all_operations` method with untrusted WSDL documents. It is under investigation whether other methods or configurations might also be vulnerable.
The recommended action is to upgrade to Savon 2.17.2 or later. Additionally, avoid using `.all_operations` for untrusted WSDL documents until further notice. For more detailed information, consult the primary sources linked below.
How 0Day mitigates this
savon is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.