Executive brief
Shiba is a live markdown preview tool that uses the js-yaml library to parse YAML content. The application defaults to the unsafe load() function instead of safeLoad(), allowing attackers to execute arbitrary code by crafting malicious YAML files. An attacker with low privileges or network access can exploit this to gain code execution with the privileges of the user running shiba.
Technical details
The vulnerability is a CWE-94 (Improper Control of Generation of Code) caused by unsafe YAML deserialization. Shiba uses js-yaml's load() function by default instead of the secure safeLoad() alternative. The load() function deserializes arbitrary JavaScript objects, enabling an attacker to instantiate malicious functions embedded in crafted YAML payloads. Exploitation requires the attacker to have low privileges or be able to deliver a malicious YAML file to the application; no user interaction is required once the file is processed. A successful exploit allows arbitrary code execution with the privileges of the process running shiba. No fixed version has been released; users are advised to upgrade js-yaml or configure the application to use safeLoad() if possible.
Affected products
- shiba shiba all versions up to 1.2.1
Timeline
- 2020-07-29: disclosed
- 2020-10-02: advisory
- 2021-05-10: other: Published to GitHub Advisory Database