pentester.land· Jan 3, 2024· by Ron Bowes (@iagox86)

Panic!! At the YAML

Open Original Article ↗
Target Program: snakeyaml
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.
#Insecure deserialization#RCE

More Writeups Like This

pentester.land

Attacking PowerShell CLIXML Deserialization

by Alexander Andersson
pentester.land

Getting code execution on Veeam through CVE-2023-27532

by Alain Mowat (@plopz0r)
pentester.land

3 ways to get Remote Code Execution in Kafka UI

by Michael Stepankin (@artsploit)
pentester.land

Shelltorch Explained: Multiple Vulnerabilities in Pytorch Model Server (Torchserve) (CVSS 9.9, CVSS 9.8) Walkthrough

by Gal Elbaz, Uri Katz, Guy Kaplan, Avi Lumelsky