CVE-2023-24621
📋 TL;DR
CVE-2023-24621 is a deserialization vulnerability in Esoteric YamlBeans that allows attackers to execute arbitrary Java code by crafting malicious YAML documents. This affects applications using YamlBeans to parse untrusted YAML input. The vulnerability exists because YamlBeans deserializes to arbitrary Java classes by default without proper validation.
💻 Affected Systems
- Esoteric YamlBeans
📦 What is this software?
Yamlbeans by Esotericsoftware
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Arbitrary code execution within the application context, potentially leading to data exposure or lateral movement.
If Mitigated
Limited impact if only trusted YAML sources are processed or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires the ability to supply malicious YAML content to a vulnerable application. No authentication needed if YAML input is accepted from untrusted sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.16 or later
Vendor Advisory: https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md
Restart Required: Yes
Instructions:
1. Update YamlBeans dependency to version 1.16 or later. 2. Rebuild and redeploy affected applications. 3. Restart services using the updated library.
🔧 Temporary Workarounds
Disable unsafe deserialization
allConfigure YamlConfig to restrict deserialization to safe classes only
YamlConfig config = new YamlConfig();
config.setClassTags(false);
YamlReader reader = new YamlReader(yamlString, config);
Input validation and sanitization
allValidate and sanitize YAML input before processing
// Implement input validation to reject suspicious YAML content
// Use allowlists for expected YAML structures
🧯 If You Can't Patch
- Implement strict input validation to reject YAML containing Java class tags or suspicious patterns
- Isolate vulnerable applications in network segments with restricted access and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if YamlBeans version is 1.15 or earlier in your project dependencies (Maven pom.xml, Gradle build.gradle, or JAR manifest).Check Version:
mvn dependency:tree | grep yamlbeans OR grep -r "yamlbeans" build.gradle OR java -jar your-app.jar --versionVerify Fix Applied:
Verify YamlBeans version is 1.16 or later and test with known malicious YAML payloads to ensure safe deserialization.📡 Detection & Monitoring
Log Indicators:
- Unexpected Java class loading during YAML parsing
- Stack traces containing deserialization errors
- Unusual process execution from application context
Network Indicators:
- Inbound YAML content containing Java class references
- Outbound connections from application to unexpected destinations
SIEM Query:
source="application.logs" AND ("ClassNotFoundException" OR "yamlbeans" OR "deserialization")