Vulnerability Principle

When PyYAML uses yaml.load() to parse untrusted data, it does not restrict dangerous YAML tags (such as !!python/object), allowing attackers to craft malicious YAML content to execute arbitrary Python code.

Payload Core:

Usage

Example:

Attack Flow

1. The script starts a TCP listener locally
2. Uploads malicious YAML file to the target /upload endpoint
3. Triggers the /login endpoint to load and parse the YAML
4. The target server executes the payload, spawning a reverse shell to the attacker

Dependency Installation

Disclaimer

⚠️ This tool is intended for security research and authorized testing only!

• Do not use for illegal purposes
• Ensure you have obtained authorization from the target system before use
• The author is not responsible for any misuse

Remediation Suggestions

1. Use yaml.safe_load() instead of yaml.load()
2. Upgrade PyYAML to version 5.4 or later
3. Strictly validate user input

References

• CVE-2020-14343 - NVD
• PyYAML Official Documentation