PT-2018-9378 · Yamldotnet · Yamldotnet

Published 2018-07-13 · Updated 2020-08-24 · CVE-2018-1000210

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YamlDotNet versions prior to 5.0.0

Description The issue concerns an Insecure Direct Object Reference vulnerability. It is related to the default behavior of Deserializer.Deserialize(), which deserializes user-controlled types and instantiates them without proper validation. This can lead to code execution in the context of the running process. The attack is exploitable via a specially-crafted YAML file that the victim must parse.

Recommendations For YamlDotNet versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user-controlled input before deserialization to minimize the risk of exploitation. Restrict access to sensitive resources and functionality that could be abused through this vulnerability.

Fix

Deserialization of Untrusted Data

IDOR

Weakness Enumeration

CWE-502

CWE-639

Related Identifiers

CVE-2018-1000210

GHSA-RPCH-CQJ9-H65R

Affected Products

Yamldotnet

References · 7

• https://osv.dev/vulnerability/GHSA-rpch-cqj9-h65r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000210 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000210 · Vendor Advisory
• https://github.com/aaubry/YamlDotNet#version-500 · Note
• https://github.com/aaubry/YamlDotNet/blob/f96b7cc40a0498f8bafdeb49df3aa23aa2c60993/YamlDotNet/Serialization/NodeTypeResolvers/TypeNameInTagNodeTypeResolver.cs#L35 · Note
• https://github.com/advisories/GHSA-rpch-cqj9-h65r · Note
• ps://github.com/aaubry/YamlDotNet · Note