3 ms·
I’ll pass on any serialization format that is itself vulnerable to RCE.
by lwansbrough 8y ago
I’ll pass on any serialization format that is itself vulnerable to RCE.
- eridius 8y agoYou can easily create a parser with RCE using just JSON. Just define a simple schema that looks like { "type": "ObjectName", … } The only difference between this and e.g. YAML is YAML has specific syntax for declaring the object type whereas with JSON you need to declare it yourself.