CVE-2017-18342: PyYAML insecure deserialization in yaml.load API

Executive brief

PyYAML is a popular software library used by developers to process YAML data files. A security flaw in older versions allows the library to execute hidden malicious commands embedded within a data file. If an application uses this library to process data from an untrusted source, an attacker could take complete control of the underlying server.

Technical details

PyYAML versions prior to 5.1 are vulnerable to a deserialization flaw (CWE-502) within the `yaml.load()` API. The root cause is the library's default behavior of allowing the instantiation of arbitrary Python objects during the parsing of YAML data. A remote, unauthenticated attacker can exploit this by providing a specially crafted YAML string that triggers the execution of arbitrary code on the host system. While a fix was attempted in version 4.1, it was yanked due to breaking changes; the vulnerability is fully addressed in version 5.1 by requiring the use of `yaml.safe_load()` or similar secure loaders.

Affected products

• PyYAML PyYAML < 5.1

Timeline

• 2019-01-04: advisory: GitHub Advisory published
• 2019-01-04: patched: Version 5.1 released with the fix

References

• https://api.github.com/users/theinfosecguy
• https://github.com/theinfosecguy
• https://api.github.com/users/theinfosecguy/gists%7B/gist_id%7D
• https://api.github.com/users/theinfosecguy/repos
• https://avatars.githubusercontent.com/u/33570148?v=4
• https://api.github.com/users/theinfosecguy/events%7B/privacy%7D