CVE-2022-1471

Summary

SnakeYaml's Constructor class, which inherits from SafeConstructor, allows any type be deserialized given the following line:

new Yaml(new Constructor(TestDataClass.class)).load(yamlContent);

Types do not have to match the types of properties in the target class. A ConstructorException is thrown, but only after a malicious payload is deserialized.

Severity

High, lack of type checks during deserialization allows remote code execution.

Proof of Concept

Execute bash run.sh. The PoC uses Constructor to deserialize a payload for RCE. RCE is demonstrated by using a payload which performs a http request to http://127.0.0.1:8000.

Example output of successful run of proof of concept:

$ bash run.sh

[+] Downloading snakeyaml if needed
[+] Starting mock HTTP server on 127.0.0.1:8000 to demonstrate RCE
nc: no process found
[+] Compiling and running Proof of Concept, which a payload that sends a HTTP request to mock web server.
[+] An exception is expected.
Exception:
Cannot create property=payload for JavaBean=Main$TestDataClass@3cbbc1e0
 in 'string', line 1, column 1:
    payload: !!javax.script.ScriptEn ... 
    ^
Can not set java.lang.String field Main$TestDataClass.payload to javax.script.ScriptEngineManager
 in 'string', line 1, column 10:
    payload: !!javax.script.ScriptEngineManag ... 
             ^

	at org.yaml.snakeyaml.constructor.Constructor$ConstructMapping.constructJavaBean2ndStep(Constructor.java:291)
	at org.yaml.snakeyaml.constructor.Constructor$ConstructMapping.construct(Constructor.java:172)
	at org.yaml.snakeyaml.constructor.Constructor$ConstructYamlObject.construct(Constructor.java:332)
	at org.yaml.snakeyaml.constructor.BaseConstructor.constructObjectNoCheck(BaseConstructor.java:230)
	at org.yaml.snakeyaml.constructor.BaseConstructor.constructObject(BaseConstructor.java:220)
	at org.yaml.snakeyaml.constructor.BaseConstructor.constructDocument(BaseConstructor.java:174)
	at org.yaml.snakeyaml.constructor.BaseConstructor.getSingleData(BaseConstructor.java:158)
	at org.yaml.snakeyaml.Yaml.loadFromReader(Yaml.java:491)
	at org.yaml.snakeyaml.Yaml.load(Yaml.java:416)
	at Main.main(Main.java:37)
Caused by: java.lang.IllegalArgumentException: Can not set java.lang.String field Main$TestDataClass.payload to javax.script.ScriptEngineManager
	at java.base/jdk.internal.reflect.UnsafeFieldAccessorImpl.throwSetIllegalArgumentException(UnsafeFieldAccessorImpl.java:167)
	at java.base/jdk.internal.reflect.UnsafeFieldAccessorImpl.throwSetIllegalArgumentException(UnsafeFieldAccessorImpl.java:171)
	at java.base/jdk.internal.reflect.UnsafeObjectFieldAccessorImpl.set(UnsafeObjectFieldAccessorImpl.java:81)
	at java.base/java.lang.reflect.Field.set(Field.java:780)
	at org.yaml.snakeyaml.introspector.FieldProperty.set(FieldProperty.java:44)
	at org.yaml.snakeyaml.constructor.Constructor$ConstructMapping.constructJavaBean2ndStep(Constructor.java:286)
	... 9 more
[+] Dumping Received HTTP Request. Will not be empty if PoC worked
GET /proof-of-concept HTTP/1.1
User-Agent: Java/11.0.14
Host: localhost:8000
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive

Further Analysis

Potential mitigations include, leveraging SnakeYaml's SafeConstructor while parsing untrusted content.

See https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479 for discussion on the subject.

Timeline

Date reported: 4/11/2022 Date fixed: 30/12/2022 Date disclosed: 10/13/2022

Red Hat Lightwell has released org.yaml:snakeyaml 1.29.0.rhlw-00021 with backported fixes for CVE-2022-1471, CVE-2022-25857, CVE-2022-38749, CVE-2022-38750, CVE-2022-38751, CVE-2022-38752, and CVE-2022-41854.

CVE-2022-1471: Remote Code execution in SnakeYAML

CVE-2022-25857: Denial of Service (DoS)

CVE-2022-38749: DoS in SnakeYAML

CVE-2022-38750: DoS in SnakeYAML

CVE-2022-38751: DoS in SnakeYAML

CVE-2022-38752: DoS in SnakeYAML

CVE-2022-41854: Stack Overflow in Snakeyaml

This patched artifact is a drop-in replacement for org.yaml:snakeyaml 1.29.0 from Maven Central.

Red Hat Lightwell has released org.yaml:snakeyaml 1.33.0.rhlw-00001 with a backported security fix.

CVE-2022-1471: Remote Code execution in SnakeYAML

This patched artifact is a drop-in replacement for org.yaml:snakeyaml 1.33.0 from Maven Central.

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.

Security Fix(es):

• SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2022-1471 in the org.yaml:snakeyaml package for Root:Maven. Multiple fixed versions available.

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.

Security Fix(es):

• SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.33.tuxcare.1.

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.26.tuxcare.1.

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.29.tuxcare.1.

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.30.tuxcare.1.

TuxCare rebuilt org.yaml:snakeyaml to address 8 CVEs. Fixed in 1.23.tuxcare.1.

TuxCare rebuilt org.yaml:snakeyaml to address 7 CVEs. Fixed in 1.28-tuxcare.1.

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.8-tuxcare.2.

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.31-tuxcare.1.

TuxCare rebuilt org.yaml:snakeyaml to address 3 CVEs. Fixed in 1.7-tuxcare.2.

TuxCare rebuilt org.yaml:snakeyaml to address 4 CVEs. Fixed in 1.6-tuxcare.1.

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.27-tuxcare.3.

These are all security issues fixed in the jackson-dataformat-csv-2.15.2-1.1 package on the GA media of openSUSE Tumbleweed.

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• CVE-2022-1471 CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 candlepin and puppetserver: various flaws
• CVE-2022-22577 tfm-rubygem-actionpack: rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack
• CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
• CVE-2022-23515 rubygem-loofah: rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting
• CVE-2022-23516 rubygem-loofah: Uncontrolled Recursion leading to denial of service
• CVE-2022-23517 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service
• CVE-2022-23518 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting
• CVE-2022-23519 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations
• CVE-2022-23520 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations
• CVE-2022-27777 tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers
• CVE-2022-31163 rubygem-tzinfo: rubygem-tzinfo: arbitrary code execution
• CVE-2022-32224 tfm-rubygem-activerecord: activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
• CVE-2022-33980 candlepin: apache-commons-configuration2: Apache Commons Configuration insecure interpolation defaults
• CVE-2022-41323 satellite-capsule:el8/python-django: Potential denial-of-service vulnerability in internationalized URLs
• CVE-2022-41946 candlepin: postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions
• CVE-2022-42003 CVE-2022-42004 candlepin: various flaws
• CVE-2022-42889 candlepin: apache-commons-text: variable interpolation RCE
• CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
• CVE-2023-23969 python-django: Potential denial-of-service via Accept-Language headers
• CVE-2023-24580 python-django: Potential denial-of-service vulnerability in file uploads

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

The items above are not a complete list of changes. This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document.