So if I had told you at Christmas three salient facts:
+ Some objects are unsafe to instantiate if you don't pick all values you initialize them with very carefully.
+ YAML can instantiate objects from any class.
+ Rails uses YAML, in a lot of ways.
You might have said "Yes, I am aware of all these three things. Do you have anything important to tell me?" Now, if I demonstrate to you working PoC code which combines those three into remote code execution, the substantial work involved in producing that PoC code -- finding the vulnerable classes which ship with Rails, demonstrating how to get data from where the user controls it into the far-inside-the-framework bits where Rails might actually evaluate YAML, etc etc -- immediately starts suggesting lots of other fun ways to use variants of that trick.
