Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2013-4660_PoC — Proof-of-concept exploit for CVE-2013-4660 demonstrating YAML deserialization remote code execution in a Dockerized Node.js environment with environment variable exfiltration. | Kitploit
Tools/GitHubGitHub/leehunkoo/cve-2013-4660_poc
Container SecurityVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCloud Security
GitHubleehunkoo/cve-2013-4660_poc

cve-2013-4660_PoC

Proof-of-concept exploit for CVE-2013-4660 demonstrating YAML deserialization remote code execution in a Dockerized Node.js environment with environment variable exfiltration.

View Repository
23 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Docker build

Build as a vulnerable environment in Docker.

  • docker build -f cve-2013-4660 -t cve-2013-4660 .

To demonstrate how sensitive information inside the server is leaked upon a successful attack, run the container by injecting a virtual database, virtual database password, and AWS key.

  • sudo docker run -d --name yaml-lab -e DB_PASSWORD="SuperSecretPassword123!" -e AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE" cve-2013-4660-test

<< Use PoC.yaml>>

Copy the PoC.yaml file into the Docker container.

  • sudo docker cp PoC.yaml yaml-lab:/usr/src/app/poc.yaml

Run the application to verify environment variable theft (trigger).

  • sudo docker exec yaml-lab node app.js
Download Tool