Savon
Monthly
Code injection in the Savon Ruby SOAP client (rubygems/savon versions 0.9.8 through 2.17.1) enables arbitrary Ruby code execution in the application process when `Savon::Model.all_operations` is called with an attacker-controlled WSDL document. WSDL operation names are interpolated directly into Ruby source strings passed to `module_eval`, allowing an attacker who serves or intercepts a malicious WSDL to escape the generated method definition and execute arbitrary code. No public exploit identified at time of analysis, though a proof-of-concept was confirmed during responsible disclosure; vendor patch was released as version 2.17.2.
Code injection in the Savon Ruby SOAP client (rubygems/savon versions 0.9.8 through 2.17.1) enables arbitrary Ruby code execution in the application process when `Savon::Model.all_operations` is called with an attacker-controlled WSDL document. WSDL operation names are interpolated directly into Ruby source strings passed to `module_eval`, allowing an attacker who serves or intercepts a malicious WSDL to escape the generated method definition and execute arbitrary code. No public exploit identified at time of analysis, though a proof-of-concept was confirmed during responsible disclosure; vendor patch was released as version 2.17.2.