Beast Attack in Hanami (Ruby)

The Beast Attack (CVE-2013-0156) is a deserialization vulnerability in Ruby on Rails that allowed remote code execution via crafted XML parameters. While Hanami does not use ActiveSupport::XmlMini by default, applications that integrate legacy Rails components, use XML parsers like Nokogiri with unsafe settings, or manually deserialize user-controlled data remain exposed. In Hanami, this risk surfaces when developers inadvertently enable unsafe YAML, Marshal, or XML loading from params without strict type validation.

For example, if a Hanami action uses YAML.load or Marshal.load on user-supplied input — perhaps to support legacy APIs or configuration overrides — an attacker can inject malicious object payloads. Unlike Rails, Hanami’s explicit action structure and reliance on dry-validation make such mistakes less common but not impossible, especially when handling webhooks, file uploads, or third-party integrations that accept XML or YAML.

middleBrick detects this vulnerability by sending serialized payloads (e.g., YAML::Erb::Template with embedded Ruby) in API parameters and observing whether the server executes arbitrary code or returns reflective error messages indicating deserialization occurred. The scanner checks for signs of object injection in responses, such as unexpected command execution or stack traces revealing internal class instantiation.

To prevent Beast Attack–style deserialization flaws in Hanami applications, avoid using YAML.load, Marshal.load, or Psych.load on untrusted input. Instead, use safe alternatives that restrict allowed classes.

Unsafe code to avoid:

# app/actions/webhooks/process.rb
module Webhooks::Process
  include Hanami::Action

  def handle(req, res)
    # DANGEROUS: loading YAML from params without restriction
    config = YAML.load(req.params[:payload])  # Vulnerable to Beast Attack
    # ... process config
  end
end

Safe remediation using Psych.safe_load:

# app/actions/webhooks/process.rb
module Webhooks::Process
  include Hanami::Action

  def handle(req, res)
    # SAFE: only allow basic types (String, Integer, Array, Hash, etc.)
    begin
      config = Psych.safe_load(req.params[:payload], permitted_classes: [String, Integer, Array, Hash, TrueClass, FalseClass, NilClass])
    rescue Psych::DisallowedClass => e
      halt 400, { error: 'Invalid payload format' }.to_json
    end
    # ... process config safely
  end
end

For XML handling, ensure parsers like Nokogiri are configured to disable DTD processing and external entity resolution:

# Prevent XXE and related risks when parsing XML
require 'nokogiri'

def parse_xml_safely(xml_string)
  document = Nokogiri::XML(xml_string) do |config|
    config.strict.nonet
  end
  document
end

Additionally, use Hanami’s strong params via req.params with schema validation (e.g., dry-validation) to enforce expected data types and structure before any processing.