RCE via legacy dependency in Python

on YouTube ↗29m

" summary

A small Flask app running in a Python 3.4 container uses PyYAML 3.13 and calls yaml.load on user-provided configs, which allows Python execution and leads to remote code execution. The demo proves this by triggering a webhook.site callback and then spawning a reverse shell via nc to pull confidential files and environment secrets. Snyk flags the dependency (recommend upgrade to 4.2) and static analysis recommends using safe_load; the exploit works end-to-end.

AI-written summary · about

" chapters (6)

1. 0:00Legacy Python risks
2. 3:28Flawed YAML validation
3. 11:40PyYAML deserialization exploit
4. 18:04Post-exploitation access
5. 23:47Static analysis detection
6. 27:22Key takeaways

" related talks

• 40mSecuring your dependenciesNina Juliadotter · NDC Sydney 2018
• 30mHow to hack an Angular app?Asim Hussain · NG-BE 2017
• 29mHack Your Own CodeAlexander Darby · PyCon Italia 2023
• 52mDevSecOpsBrian Vermeer · Devnexus 2022
• 18mLive Exploiting Your Open Source DependenciesBrian Vermeer · CodeLand 2020
• 43mUnique ways to Hack into a Python Web ServiceTilak T · DjangoCon US 2018
• 25mUnexpected Execution: Wild Ways Code Execution can Occur in PythonGraham Bleaney, the_storm · PyCon US 2021
• 31mStranger Danger: Addressing Vulnerable CF Application DependenciesGuy Podjarny · Cloud Foundry Summit Silicon Valley 2017