Hands-On Application Penetration Testing with Burp Suite

Exploiting the vulnerability

Imagine you have a vulnerable application that is using the pickle library. This is a Python module that implements different functions to serialize and deserialize. However, this module does not implement protection by itself. It needs to be implemented with validation by the developer. Look at the following vulnerable code snippet:

import yaml 
with open('malicious.yml') as yaml_file: 
contents = yaml.load(yaml_file) 
print(contents['foo'])

This code reads a YAML file without any validations. A malicious user can enter an input that could execute other actions, for example, a command, as follows:

POST /api/system/user_login HTTP/1.1 Host: 192.168.1.254 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) ...