CVE-2020-14343: PyYAML Library RCE Vulnerability

CVE-2020-14343 Overview

A critical arbitrary code execution vulnerability was discovered in the PyYAML library in versions before 5.4. The vulnerability allows attackers to execute arbitrary code when applications process untrusted YAML files through the full_load method or with the FullLoader loader. This flaw enables an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. Notably, this vulnerability exists due to an incomplete fix for CVE-2020-1747, indicating that previous remediation attempts failed to fully address the underlying insecure deserialization issue.

Critical Impact

Applications processing untrusted YAML input using PyYAML's full_load method or FullLoader loader are vulnerable to complete system compromise through arbitrary code execution.

Affected Products

• PyYAML versions prior to 5.4
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment 1.10.0
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.1.0

Discovery Timeline

• 2021-02-09 - CVE-2020-14343 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-14343

Vulnerability Analysis

This vulnerability is classified as Insecure Deserialization (CWE-20: Improper Input Validation). The PyYAML library provides multiple loaders for parsing YAML documents, with FullLoader intended as a safer alternative to the completely unrestricted Loader. However, the FullLoader implementation fails to adequately restrict dangerous YAML constructs, specifically the python/object/new constructor.

When a malicious YAML document containing crafted python/object/new directives is processed by yaml.full_load() or explicitly using FullLoader, PyYAML instantiates arbitrary Python objects. An attacker can leverage this to invoke dangerous functions such as os.system(), subprocess.Popen(), or any other callable available in the Python environment, achieving remote code execution.

The vulnerability is network-exploitable without authentication or user interaction, making it particularly dangerous in web applications, APIs, and microservices that accept YAML input from untrusted sources.

Root Cause

The root cause stems from PyYAML's FullLoader failing to completely block dangerous Python object constructors. Despite being introduced as a "safer" alternative after previous security issues, the FullLoader implementation contained gaps that allowed the python/object/new constructor to bypass security restrictions. This represents an incomplete fix for CVE-2020-1747, where similar object instantiation attacks were possible.

Attack Vector

The attack vector requires an application to process attacker-controlled YAML content using the vulnerable loader methods. Common attack scenarios include:

1. Web applications accepting YAML configuration uploads
2. APIs parsing YAML request bodies
3. Configuration management systems processing external YAML files
4. CI/CD pipelines parsing untrusted repository files

When a malicious YAML payload containing the python/object/new constructor is parsed, the attacker gains the ability to execute arbitrary Python code with the privileges of the application process. The python/object/new tag instructs PyYAML to instantiate an arbitrary Python class, and by specifying dangerous classes like those in the subprocess module, attackers achieve code execution.

Detection Methods for CVE-2020-14343

Indicators of Compromise

• Unexpected child processes spawned by Python applications that process YAML input
• Network connections originating from application processes after YAML parsing operations
• Log entries showing YAML parsing errors with python/object/new or similar constructor tags
• File system modifications or new file creation following YAML processing

Detection Strategies

• Monitor application dependencies for PyYAML versions prior to 5.4 using software composition analysis (SCA) tools
• Implement runtime application self-protection (RASP) to detect suspicious object instantiation during YAML parsing
• Analyze incoming YAML payloads for dangerous tags such as !!python/object/new, !!python/object/apply, and similar constructs
• Deploy network monitoring to detect anomalous outbound connections from application servers

Monitoring Recommendations

• Audit Python applications for usage of yaml.full_load(), yaml.load(..., Loader=FullLoader), or yaml.unsafe_load() methods
• Implement centralized logging for all YAML parsing operations with payload inspection capabilities
• Configure alerting for any process execution anomalies associated with Python web applications
• Review application logs for exceptions related to YAML object construction failures

How to Mitigate CVE-2020-14343

Immediate Actions Required

• Upgrade PyYAML to version 5.4 or later immediately across all affected systems
• Audit all applications to identify usage of full_load() or FullLoader and replace with safe_load() where possible
• Implement input validation to reject YAML documents containing Python object tags before parsing
• Consider using yaml.safe_load() as the default loader, which restricts parsing to basic YAML types only

Patch Information

The vulnerability is resolved in PyYAML version 5.4 and later. Oracle has released patches for affected Communications Cloud Native Core products as documented in their April 2022 Security Alert and July 2022 Security Alert. Additional technical details are available in the PyYAML GitHub Issue #420 and Red Hat Bug Report #1860466.

Workarounds

• Replace all instances of yaml.full_load() with yaml.safe_load() which only permits basic YAML tags
• If FullLoader functionality is required, implement a custom loader that explicitly blacklists dangerous constructors
• Deploy Web Application Firewall (WAF) rules to block YAML payloads containing !!python/object tags
• Run applications processing untrusted YAML in sandboxed environments with restricted system access

# Upgrade PyYAML to patched version
pip install --upgrade "pyyaml>=5.4"

# Verify installed version
pip show pyyaml | grep Version

# Search codebase for vulnerable patterns
grep -rn "full_load\|FullLoader" --include="*.py" .