TIL most popular languages' yaml libraries *intentionally* allow arbitrary code execution. WTF. https://arp242.net/weblog/yaml_probably_not_so_great_after_all.html …
Not that I'm aware of. The linked article is a starting point I guess. Probably need to read the spec too and figure out what this hideous construct is...
-
-
It's the ability for the serialized form to specify the type it is to deserialize into. The RCE occurs when you can figure out how to make that run specific code.
- End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.