Arbitrary Code Execution in YAML Perl Module

Executive Summary

This vulnerability in YAML versions before 1.27_001 for Perl allows a loaded perl/glob document to replace any package variable, potentially leading to arbitrary code execution. The issue arises because a perl/glob document can name a package and symbol, including critical variables like @INC or YAML's own load options, without restriction.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses YAML versions before 1.27_001 for Perl. Inspect Perl modules and YAML library versions installed. Look for usage of $YAML::LoadCode or $YAML::UseCode flags in codebases that process YAML files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by supplying two documents to separate Load() calls in one process. If $YAML::LoadCode or $YAML::UseCode is set to true, code loading is enabled, and a perl/code document is passed to a string eval, allowing arbitrary Perl code execution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary code execution through YAML parsing, which could lead to unauthorized data access, modification, or exfiltration. Such risks may violate GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information if exploited in systems handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the YAML Perl module to version 1.27_001 or later. Review and remove any instances of $YAML::LoadCode or $YAML::UseCode flags in your code. Ensure glob loading is disabled by default in YAML processing.

Useful 0 Not Useful 0