PT-2018-9378 · Yamldotnet · Yamldotnet

Publicado 2018-07-13 · Atualizado 2020-08-24 · CVE-2018-1000210

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YamlDotNet versions prior to 5.0.0

Description The issue concerns an Insecure Direct Object Reference vulnerability. It is related to the default behavior of Deserializer.Deserialize(), which deserializes user-controlled types and instantiates them without proper validation. This can lead to code execution in the context of the running process. The attack is exploitable via a specially-crafted YAML file that the victim must parse.

Recommendations For YamlDotNet versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user-controlled input before deserialization to minimize the risk of exploitation. Restrict access to sensitive resources and functionality that could be abused through this vulnerability.

Correção

Deserialization of Untrusted Data

IDOR

Enumeração de Fraquezas

CWE-502

CWE-639

Identificadores relacionados

CVE-2018-1000210

GHSA-RPCH-CQJ9-H65R

Produtos afetados

Yamldotnet

Referências · 7

• https://github.com/aaubry/YamlDotNet#version-500 · Nota
• https://github.com/aaubry/YamlDotNet/blob/f96b7cc40a0498f8bafdeb49df3aa23aa2c60993/YamlDotNet/Serialization/NodeTypeResolvers/TypeNameInTagNodeTypeResolver.cs#L35 · Nota
• https://osv.dev/vulnerability/GHSA-rpch-cqj9-h65r · Aviso do Fabricante
• https://github.com/advisories/GHSA-rpch-cqj9-h65r · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000210 · Nota de Segurança
• ps://github.com/aaubry/YamlDotNet · Nota
• https://osv.dev/vulnerability/CVE-2018-1000210 · Aviso do Fabricante