Detect kobako Sandbox Escape to Host RCE (CVE-2026-55107) in Elastic Security
Detects exploitation of CVE-2026-55107, a critical (CVSS 10.0) sandbox escape in the kobako Ruby gem (versions >= 0.1.0, <= 0.9.0). kobako is intended to safely evaluate untrusted guest Ruby expressions, but its guest object forwards unknown methods through method_missing directly into public_send on any bound Service object. An attacker who can supply a guest expression can therefore invoke arbitrary public methods on host-side Service objects — chaining to send, instance_variable_get, or Service methods that reach system/eval — achieving host remote code execution. Detection focuses on the runtime side effects of an escape: Ruby/Rack worker processes (running kobako-backed evaluation) spawning shells, interpreters, reconnaissance binaries, or network tools; unexpected child processes of puma/unicorn/rails; and process-command-lines that reveal method_missing/public_send abuse patterns. Because the vulnerability lives inside a normally-sandboxed eval path, ANY OS command execution originating from the evaluating worker is high-signal.
MITRE ATT&CK
- Tactic
- Execution Privilege Escalation
Elastic Detection Query
process where event.type == "start" and
process.parent.name in ("ruby","rails","puma","unicorn","rackup","sidekiq","bundle","irb") and
process.name in ("sh","bash","dash","zsh","nc","ncat","netcat","curl","wget","python","python3","perl","id","whoami","uname","chmod","base64") and
not process.command_line like~ ("*assets:precompile*","*webpack*","*bundle install*")EQL sequence-free rule matching a Ruby/Rack parent (kobako evaluator) directly launching a shell or recon binary, the hallmark of CVE-2026-55107 host code execution.
Data Sources
Required Tables
False Positives & Tuning
- Build and deployment pipelines invoking shells from Ruby tooling.
- Background jobs calling native media/conversion utilities.
- Developer debugging via irb spawning subshells.
Other platforms for CVE-2026-55107
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate kobako guest-eval escape to shell (lab)
Expected signal: ProcessRollup2 / auditd process-exec event with parent ruby and child sh executing id and uname.
- Test 2Simulate host recon via escaped Ruby worker
Expected signal: Process-launch events showing ruby spawning whoami and curl.
- Test 3Benign Ruby deploy shell-out (false-positive check)
Expected signal: Process-launch event with parent ruby and child sh whose command line contains assets:precompile.
Response Playbook
Triage
- Identify the alerting host and confirm whether it runs an application embedding the kobako gem; run `gem list kobako` / inspect Gemfile.lock and confirm the version falls within >= 0.1.0, <= 0.9.0 (fixed in 0.9.1).
- Pull the full process tree for the flagged event: confirm the parent is a kobako-backed evaluation worker (puma/unicorn/rails) and inspect the child command line for shell, recon (id/whoami/uname), or network (curl/wget/nc) activity.
- Correlate the process timestamp with application/HTTP access logs to locate the inbound request or job that supplied the guest expression; look for payloads containing `public_send`, `method_missing`, `send`, `instance_variable_get`, or backtick/`system`/`eval` strings.
- Determine whether the spawned command succeeded and what it accessed (outbound connections, files read/written, credentials touched) to gauge blast radius.
Containment
- Isolate the affected host from the network to stop any established reverse shell or C2 channel while preserving volatile evidence.
- Disable or rate-limit the endpoint that accepts untrusted guest expressions, or take the kobako-backed feature offline until the gem is upgraded to 0.9.1+.
- Rotate any credentials, tokens, or secrets reachable from the application process, since host RCE exposes the full application environment.
Evidence Collection
- Capture the full process command lines, parent/child relationships, and environment of the offending worker process (e.g., from EDR timeline or /proc before termination).
- Preserve application logs, reverse-proxy/access logs, and the specific request/job payload that carried the guest expression.
- Collect network connection records (netstat/conntrack, firewall/proxy logs) for outbound connections initiated by the worker around the event time.
Escalation Criteria
- !Escalate to incident response immediately if the spawned process established an outbound/reverse connection, wrote executables, or accessed credential material — treat as confirmed host RCE.
- !Escalate if the same guest-expression payload pattern is observed against multiple hosts or repeatedly, indicating active campaign exploitation.
- !Escalate to application owners and change management to force the kobako upgrade and validate no persistence (cron, systemd units, authorized_keys) was planted.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Application worker process command lines and parent-child process tree showing ruby→shell transitions. - >
Reverse-proxy / application access logs containing the guest expression payload (method_missing/public_send/send patterns). - >
Newly created files, cron entries, systemd units, or authorized_keys modifications timestamped near the event. - >
Outbound network connection logs from the worker process (potential reverse shell / C2).
Tuning Guidance
Baseline which Ruby application hosts legitimately shell out (asset compilation, media processing, deploy hooks) and add those specific parent+command patterns to the exclusion clause rather than removing the parent list. If kobako is confirmed absent, scope the rule to hosts running the affected application. Prioritize alerts where the child is a network tool (nc/curl/wget) or where the command line contains base64/decoded payloads, and lower priority for read-only recon (id/whoami) that may reflect benign health checks. Once all instances are patched to 0.9.1+, retain the rule as a defense-in-depth control for anomalous Ruby subprocess behavior.
Hunting Queries
Hunts for any Ruby/Rack application worker spawning shell or network utility children across the fleet — surfaces kobako escape attempts even when the specific recon binary differs from the detection allowlist.
DeviceProcessEvents | where InitiatingProcessFileName has_any ("ruby","puma","unicorn","rails") | where FileName in~ ("sh","bash","nc","curl","wget","python3") | summarize count(), makeset(ProcessCommandLine) by DeviceName, bin(Timestamp, 1h)index=* (sourcetype=linux:audit OR sourcetype=sysmon) parent_process_name IN (ruby,puma,unicorn,rails) process_name IN (sh,bash,nc,curl,wget,python3) | stats count values(CommandLine) by host, parent_process_nameAtomic Red Team Tests
Emulates a kobako evaluator worker forking a shell as a result of a guest expression reaching host public_send, producing the parent→child telemetry the detection relies on.
Command
ruby -e 'system("/bin/sh -c \"id; uname -a\"")'Cleanup
echo 'no cleanup required - read-only recon commands'Expected Telemetry
ProcessRollup2 / auditd process-exec event with parent ruby and child sh executing id and uname.
Expected Detection
true
Runs reconnaissance binaries under a Ruby parent to mimic post-escape enumeration on the host.
Command
ruby -e 'exec("whoami")' &
ruby -e 'system("curl -s http://127.0.0.1:9/ || true")'Cleanup
pkill -f 'ruby -e' 2>/dev/null || trueExpected Telemetry
Process-launch events showing ruby spawning whoami and curl.
Expected Detection
true
Executes a Ruby-parented asset-compilation-style shell command that should be excluded by the detection's tuning clause, validating false-positive handling.
Command
ruby -e 'system("sh -c \"echo assets:precompile done\"")'Cleanup
echo 'no cleanup required'Expected Telemetry
Process-launch event with parent ruby and child sh whose command line contains assets:precompile.