Deserialization Vulnerability by yaml config input in super-xray

Vulnerability

super-xray versions prior to 0.7 (specifically 0.6-beta and below) load the program configuration from a YAML file without safe parsing. The code uses new Yaml() which permits arbitrary object deserialization via the SnakeYAML library, as shown in the commit diff [1] and the advisory [2]. This vulnerability is present in the LookupConfigForm and MainForm classes where user-supplied YAML is loaded.

Exploitation

An attacker with local access to the config file can craft a malicious YAML payload. The attack requires high privileges (local file write) and user interaction (the victim must load the modified config). The advisory [2] provides a proof-of-concept using !!javax.script.ScriptEngineManager to load a remote class via a URLClassLoader, leading to arbitrary code execution.

Impact

Successful exploitation results in arbitrary code execution with the privileges of the super-xray process. The advisory [2] rates the impact as high for confidentiality, integrity, and availability, with no scope change.

Mitigation

The fix, implemented in commit 4d0d5966 [1], replaces new Yaml() with new Yaml(new SafeConstructor(new LoaderOptions())) to disable unsafe deserialization. Users should upgrade to super-xray 0.7 when released. No workarounds are available [2].