It is not safe to call yaml.load with any data received from an untrusted source. The yaml.load function provides the ability to construct an arbitrary Python object, which may be dangerous if you receive a YAML document from an untrusted source.

Deserialization of untrusted data exposes application to:

Parameter tampering attacks: Manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc.
Remote code execution attacks: Structure of unserialized data is changed to modify the behavior of object being unserialized.

It is recommended to use yaml.safe_load. The function yaml.safe_load limits this ability to simple Python objects like integers or lists.

Bad practice

from flask import request

import yaml

@app.route('/yaml')
def load():
    data = request.GET.get("data")
    conf = yaml.load(data) # Insecure. Avoid using yaml.load

Recommended

from flask import request

import yaml

@app.route('/yaml')
def load():
    data = request.GET.get("data")
    conf = yaml.safe_load(data) # Secure

References:

pyyaml
Web parameter tampering
Code injection
OWASP Top 10 2021 Category A08 - Software and Data Integrity Failures
SAN Top 25
CWE 502 - Deserialization of untrusted data

OreosLab / SSRSpeedN

No ignore rules found