PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Extending Ruzzy with LibAFL

blog.trailofbits.com | research | #appsec | #ruby | #fuzzing | #application-security | #tool-release | #llvm | #libafl | #libfuzzer
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits added LibAFL support to Ruzzy, its coverage-guided fuzzer for Ruby and Ruby C extensions, via LibAFL's libFuzzer compatibility layer—no changes needed to existing harnesses.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Introducing Ruzzy, a coverage-guided Ruby fuzzer
Trail of Bits released Ruzzy, a coverage-guided fuzzer for pure Ruby and Ruby C extensions, built on libFuzzer with Atheris inspiration and ASan/UBSan support to find DoS and memory corruption bugs.
blog · blog.trailofbits.com
gosentry brings LibAFL-grade fuzzing to Go's native interface
gosentry is a Trail of Bits fork of the Go toolchain that keeps the standard testing.F harness while running go test -fuzz on LibAFL, adding struct-aware, grammar-based fuzzing and new bug detections.
research · portswigger.net
The Fragile Lock: Novel Bypasses For SAML Authentication
Novel SAML signature-wrapping attacks — attribute pollution, namespace confusion and Void Canonicalization — achieve full authentication bypass in Ruby and PHP libraries, including GitLab Enterprise.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · depthfirst.com
Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem
The investigation shows how memory-safety flaws in native Ruby gems can become remotely reachable through widely deployed applications such as GitLab. Teams should inventory native-extension dependencies and move self-managed GitLab and Oj installations to fixed releases.
research · depthfirst.com
Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.
Back