CVE-2022-1471

This PoC demonstrates CVE-2022-1471, a deserialization vulnerability in SnakeYAML 1.33, allowing arbitrary code execution via crafted YAML input. The exploit triggers a network request to a controlled server, proving the vulnerability.

This repository contains functional exploit code for multiple CVEs, including deserialization and RCE vulnerabilities in Java-based software. The PoCs are well-structured and include actual exploit code for vulnerabilities like CVE-2022-42889 (commons-text), CVE-2023-23638 (dubbo), and others.

This repository contains a proof-of-concept exploit for CVE-2022-1471, demonstrating deserialization vulnerabilities in SnakeYAML. The PoC includes a web server that serializes and deserializes YAML payloads, with instructions to trigger an HTTP GET request to an attacker-controlled server.

This repository demonstrates multiple CVEs, including CVE-2022-1471 (SnakeYAML deserialization RCE), CVE-2022-42003 (Jackson polymorphic deserialization), and CVE-2022-42889 (Text4Shell). It includes functional exploit code for these vulnerabilities in a Spring Boot application.

This is a functional PoC for CVE-2022-1471, a SnakeYAML deserialization vulnerability. It exploits unsafe Yaml.load() to inject a Tomcat Valve or start a standalone HTTP server, replacing the target application with a 'PWNED' page.

This Metasploit module exploits a chain of vulnerabilities in PyTorch TorchServe, including CVE-2023-43654 (SSRF in model registration) and CVE-2022-1471 (SnakeYAML deserialization RCE), to achieve unauthenticated remote code execution by registering a malicious MAR file containing a crafted YAML payload.