Making Open Source Safer for Everyone with Shopify’s Bug Bounty Program

Summary

Shopify describes how a bug bounty report led to application fixes and Rails contributions aimed at making open-source software safer. The 2021 Shopify Experiments report showed that a leaked development-environment secret could be used to generate trusted-looking data and reach remote code execution in a local development environment. The root cause was ActiveSupport’s MessageEncryptor using Ruby’s unsafe Marshal serializer by default in Rails versions up to 7.0.X, allowing untrusted data to trigger deserialization risks. Shopify first configured JSON in its application, then helped change the default serializers for MessageEncryptor and MessageVerifier to JSON in Rails 7.1.X, with an upgrade path for existing applications. It also developed a patch that monitors Marshal load and dump calls, raises on unexpected gem-originated calls, and runs in local development and continuous integration to prevent new usage.

Context

A bug bounty report demonstrated that leaking an application secret from a development environment could enable remote code execution locally. The root cause was Rails ActiveSupport’s MessageEncryptor using the unsafe Ruby Marshal serializer by default, allowing seemingly valid untrusted data to reach a deserialization vulnerability.

Approach / What changed

Shopify patched its application to use JSON with MessageEncryptor, then wrote Rails patches changing the default serializers for MessageEncryptor and MessageVerifier to JSON beginning in Rails 7.1.X. It also provided an upgrade path for existing applications and developed a Ruby patch that tracks Marshal load and dump calls, raises on unexpected gem-originated calls, and runs in local development and continuous integration.

Takeaways

• A leaked development secret could be used to create seemingly trusted data for ActiveSupport’s MessageEncryptor, reaching a deserialization vulnerability and remote code execution in a local development environment.
• Rails changed the default serializer for MessageEncryptor and MessageVerifier to JSON beginning in version 7.1.X, while providing an upgrade path for applications using the previous default.
• Shopify’s Marshal-monitoring patch raises on unexpected calls from gems and runs in development and continuous integration to prevent new usage while maintaining a list of dependencies that still rely on Marshal.

Related reading