CVE-2021-22557
Code execution in SLO Generator via YAML Payload
In short
SLO Generator can execute arbitrary code when processing specially crafted YAML files. An attacker who can provide a malicious YAML file to the application could run code with the privileges of the SLO Generator process.
Technical detail
The vulnerability exists in YAML file parsing without proper deserialization controls (CWE-94). An attacker can craft a YAML payload that triggers code execution during file loading. Exploitation requires the ability to supply or control YAML input to the SLO Generator application.
Summary generated and translated by AI from the official description.
SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Google LLC · SLO Generatorpublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/164426/Google-SLO-Generator-2.0.0-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50385unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →