Description

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-10-12T16:17:04.373Z",
  "pubdate": "2026-10-12T16:17:04.373Z",
  "executiveSummary": "Square Squash, through commit e73f280, is affected by a critical insecure deserialization vulnerability. This vulnerability resides within the symbolication process, allowing unauthenticated attackers to supply arbitrary YAML payloads via the POST /api/1.0/symbolication endpoint.\nThe vulnerability stems from the application's unsafe handling of attacker-supplied data during YAML deserialization. By passing user-controlled input into YAML.load with SafeYAML configured in an unsafe mode, the application becomes susceptible to arbitrary Ruby object instantiation.\nSuccessful exploitation allows a remote, unauthenticated attacker to achieve remote code execution (RCE) on the server hosting the Square Squash instance. This represents a critical risk, as it grants attackers full control over the execution environment, potentially leading to unauthorized data access, system compromise, or lateral movement within the infrastructure.\nNo authentication is required to initiate the attack flow, and the exploitation vector is network-accessible. Immediate remediation is necessary to prevent potential exploitation.",
  "technicalDetails": "The vulnerability is rooted in the improper handling of YAML data within the symbolication pipeline of Square Squash. Specifically, the application exposes the POST /api/1.0/symbolication endpoint, which permits the storage of user-supplied symbolication metadata. This data is associated with specific UUIDs provided by the attacker.\nThe primary mechanism of exploitation involves the subsequent processing of these stored values. When an occurrence referencing an attacker-controlled symbolication UUID is triggered for symbolication, the application retrieves the previously stored malicious YAML payload.\nThe critical failure occurs during the deserialization phase, where the retrieved data is processed using YAML.load with SafeYAML configured in an unsafe operational mode. In Ruby, YAML.load is inherently dangerous when processing untrusted input; it facilitates the instantiation of arbitrary Ruby objects defined within the YAML stream. By crafting a payload that leverages specific 'gadget chains'—classes available in the application's runtime environment that execute malicious code during object initialization or serialization/deserialization cycles—an attacker can bypass security controls.\nThe attack flow proceeds as follows: 1) The attacker sends a POST request to /api/1.0/symbolication containing a crafted YAML payload. 2) The server stores this payload in its backend storage, associated with a user-defined UUID. 3) The attacker triggers a symbolication request for an occurrence linked to the injected UUID. 4) The Square Squash backend fetches the payload from storage and passes it to YAML.load. 5) The Ruby runtime interprets the YAML, instantiating the malicious gadget chain. 6) The gadget chain executes, granting the attacker arbitrary code execution with the privileges of the application process.\nThis vulnerability persists up to and including commit e73f280. Because the endpoint is reachable without authentication, the attack surface is exposed to any network participant capable of reaching the API. Post-exploitation impact includes complete system compromise, as the attacker operates within the application's process space, enabling file system access, credential exfiltration, and further network probing."
}