vulhub/yaml-payload

yaml-payload is a tiny tool used in security testing to exploit a specific weakness in SnakeYAML, a popular Java library for reading configuration files. It helps penetration testers and security researchers demonstrate how a server that naively processes untrusted YAML input can be tricked into running malicious code. Many applications use YAML files for configuration, and SnakeYAML can automatically turn YAML text into live Java objects. The project exploits this by crafting a special YAML snippet that references a custom Java package (a JAR file) hosted on an attacker-controlled web server. When the vulnerable application reads that snippet, it fetches the package from the URL and executes its code. The workflow is straightforward for someone doing offensive security work. You put the Java commands you want to run into a provided source file, compile it into a JAR package, and host that package on a web server you control. You then feed the target application the YAML snippet so it downloads and executes your package, proving the server is vulnerable. The README doesn't go into detail on remediation or broader context, it focuses narrowly on the mechanics of generating the payload. This project would be used by penetration testers, red teamers, or developers verifying whether their own apps are exposed. A concrete example: a security consultant auditing a Java-based microservice that accepts user-supplied YAML for dynamic configuration would use this to show the client that a malicious user could achieve remote code execution. It is strictly an offensive-security aid, not a defensive library. Its notable tradeoff is simplicity and narrow scope, it packages one well-known gadget rather than offering a framework, which keeps it small but limits it to scenarios where SnakeYAML's unsafe deserialization is actually reachable.