CVE-2022-1471

Overview

SnakeYAML is a popular Java library for parsing and emitting YAML documents.

‍

A remote code execution vulnerability (CVE-2022-1471) has been identified in SnakeYAML, which allows attackers to execute Java code in an application that is using SnakeYAML by providing a specially crafted YAML document for deserialization.

‍

Per OWASP: Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application. This type of attack exploits poor handling of untrusted data. These types of attacks are usually made possible due to a lack of proper input/output data validation.

‍

This issue affects all 1.x versions of SnakeYAML.

‍

Details

Module Info

• Product: SnakeYAML
• Affected packages: snakeyaml
• Affected versions: >=1.0, <=1.33
• GitHub repository: https://github.com/snakeyaml/snakeyaml
• Published packages: https://repo1.maven.org/maven2/org/yaml/snakeyaml 
• Package manager: maven
• Fixed in: NES for SnakeYAML v1.34.0

‍

Vulnerability Info

This high-severity vulnerability is found in all 1.x versions of the org.yaml:snakeyaml artifact from the SnakeYAML project.

SnakeYAML versions 1.x provide two means of creating a parser object that can be used to populate a Java object from a YAML document - a Constructor class and a SafeConstructor class. The SafeConstructor class restricts the set of types that can be instantiated when YAML is being deserialized. The Constructor class does not restrict the types that can be instantiated, which could allow remote code execution during deserialization.

‍

Mitigation

SnakeYAML 1.x is End-of-Life and will not receive any updates to address this issue. 

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade applications to use SnakeYAML 2.x.
• Use SafeConstructor instead of Constructor when creating a YAML parser with SnakeYAML 1.x.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍