YAML <1.30 (Perl) DESTROY RCE via yaml_loader
CVE-2017-20285 Published on October 5, 2026
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.
What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.
Vulnerability Analysis
CVE-2017-20285 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Timeline
Issue reported.
Version 1.25 released with the $YAML::LoadBlessed option. 366 days later.
Version 1.30 released with the option defaulting to off. 626 days later.
Issue added as CPANSA-YAML-2017-01 in the CPAN::Audit database. 882 days later.
CVE number reserved. 1547 days later.
Weakness Types
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2017-20285 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
What is a Reflection Injection Vulnerability?
The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. If the application uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the application to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the application's classpath (CWE-427) or add new entries to the application's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the application.
CVE-2017-20285 has been classified to as a Reflection Injection vulnerability or weakness.
Products Associated with CVE-2017-20285
Want to know whenever a new CVE is published for Canonical Ubuntu Linux? stack.watch will email you.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.