PANIC!! AT THE YAML

Summary from the TLDR InfoSec newsletter

This post contains a deep dive into a remote code execution vulnerability in the SnakeYAML library. The post begins with describing how !! fields work in YAML and how the deserialization vulnerability allows for instantiating Java classes. It then goes through the process of developing an exploit against the vulnerability to eventually achieve remote code execution.