CVE-2019-25777

Summary

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.

A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.

A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.

Affected Software

VendorProductVersion RangeStatus
0 < 1.27_001affected

Weaknesses

  • CWE-914: CWE-914 Improper Control of Dynamically-Identified Variables
  • CWE-502: CWE-502 Deserialization of Untrusted Data

Workarounds

For deployments that cannot upgrade to YAML 1.28, set $YAML::LoadBlessed = 0 before loading untrusted input. The option exists from YAML 1.25 and gates glob loading too.

ADP Enrichment

CVE Program Container

Additional References

References