# Pre-Auth RCE in Aspera Faspex: Case Guide for Auditing Ruby on Rails

Unauthenticated YAML.load on external_emails parameter in Aspera Faspex package_relay controller enables Ruby deserialization RCE via crafted gadget chain.

- Payout: Research
- Severity: critical
- Program: IBM Aspera Faspex
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2022-47986
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/pre-auth-rce-in-aspera-faspex-case-guide-for-auditing-ruby-on-rails
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-pre-auth-rce-in-aspera-faspex-case-guide-for-auditing-ruby-on-rails
- Tags: domain:web impact:rce kind:research platform:research sev:critical tech:ruby technique:chained technique:source-review vuln:deserialization vuln:rce

**Target:** Ruby on Rails web application (Aspera Faspex)
**Root cause:** The relay_package action passes user-controlled external_emails parameter to YAML.load without sanitization, allowing instantiation of arbitrary Ruby objects.
**Steps:**
1. Identify unauthenticated route POST /aspera/faspex/package_relay/relay_package
2. Trace params to MultiServer::RelayDescriptor.parse, which calls YAML.load(enc_emails)
3. Craft YAML gadget chain using Gem::Installer, Gem::SpecFetcher, Gem::Requirement, Gem::Package::TarReader, Net::BufferedIO, Net::WriteAdapter, PrettyPrint to invoke Kernel.eval with command
4. Send POST request with JSON body containing external_emails set to the YAML payload and other required parameters (package_file_list, package_name, etc.)
5. Command executes on server
**How found:** Auditing Ruby on Rails application, focusing on unauthenticated controllers. Identified YAML.load sink in relay_package controller, traced taint from params to sink, then developed a reliable deserialization gadget chain compatible with the Ruby version shipped with Aspera Faspex.
**Exploitation:** Attacker sends a single unauthenticated POST request to /aspera/faspex/package_relay/relay_package with a JSON body where external_emails contains a malicious YAML document. The YAML deserialization triggers a gadget chain that calls Kernel.eval with an arbitrary command, achieving remote code execution as the web server user.
**Insight:** When auditing Rails apps, grep for YAML.load, Oj.load, and other deserialization sinks in unauthenticated controllers; trace params to confirm user control. Static SECRET_KEY_BASE can also enable deserialization RCE via session cookies.