Code execution in SLO Generator via YAML Payload

Vulnerability

The SLO Generator, an open-source tool for computing service level objectives, contains a code execution vulnerability due to the use of yaml.load() with the default yaml.Loader in YAML file loading functions. The vulnerable code is present in the exporters_v1tov2() and ebp_v1tov2() functions, which load YAML configuration files without safely restricting deserialization. This allows an attacker who can provide a crafted YAML file to execute arbitrary Python code. The vulnerability affects all versions before the fix was merged in pull request #173 and released in version 2.0.1 [1][4].

Exploitation

An attacker needs the ability to supply a malicious YAML file that will be loaded by the SLO Generator. This could be achieved through direct file upload, by convincing a user or automated process to use the crafted file as configuration, or by any means that places a malicious YAML file in a path that SLO Generator reads. The attacker does not need privileged access to the system; the malicious file can be crafted using YAML tags that invoke Python functions on deserialization (e.g., !!python/object:__main__.some_class). No additional authentication or user interaction beyond loading the file is required [1][4].

Impact

Successful exploitation results in arbitrary code execution within the context of the SLO Generator process. This can lead to full compromise of the application and the underlying system, including data exfiltration, installation of backdoors, or lateral movement depending on the environment. The vulnerability has a CVSS score not yet provided by NVD, but the inherent risk is high due to the remote code execution nature [1][2].

Mitigation

The vulnerability is fixed in SLO Generator version 2.0.1, which changes the YAML loader from yaml.Loader to yaml.SafeLoader for all YAML loading operations [2][4]. Users should upgrade to version 2.0.1 or later immediately. There is no known workaround; if upgrading is not immediately possible, users should avoid using untrusted YAML files with SLO Generator and review any custom configuration sources. The fix was committed in commit 36318beab1b85d14bb860e45bea186b184690d5d [4]. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of publication.