CVE-2019-25777

Executive Summary

CVE-2019-25777 is a deserialization vulnerability in the Perl YAML module (versions before 1.27_001) that permits arbitrary package variable manipulation via a perl/glob document, leading to arbitrary code execution. Any application that uses the affected YAML module to parse untrusted YAML input is impacted, with the attacker potentially gaining full control over the process and the underlying host. The vulnerability is unpatched, has no public exploit code, and presents a critical risk due to its remote, unauthenticated exploitation vector.

Technical Analysis

The vulnerability resides in the Perl YAML module's handling of perl/glob documents. A perl/glob document is a special YAML document type that names a package and a symbol (variable) and supplies a value to be assigned to that symbol. The module does not restrict the name of the package or symbol being targeted, allowing an attacker to replace any package variable in the Perl process. This unrestricted assignment enables manipulation of critical variables such as @INC (the Perl module search path) and the YAML module's own load options ($YAML::LoadCode and $YAML::UseCode).

The attack mechanism is two-staged. First, an attacker supplies a perl/glob document that sets $YAML::LoadCode or $YAML::UseCode to a true value. By default, code loading is disabled in the YAML module. Once these variables are set, code loading remains enabled for every subsequent Load() call in the same process. Second, the attacker supplies a perl/code document to a later Load() call. Because code loading is now enabled, the content of the perl/code document is passed to a string eval, resulting in arbitrary Perl code execution within the context of the vulnerable application. The two documents can be delivered to separate Load() calls within the same process, meaning the attacker only needs to influence two distinct YAML parsing operations to achieve full code execution.

This is a classic deserialization-of-untrusted-data vulnerability (CWE-502). The attack surface is any application that parses YAML from an untrusted source using the affected Perl YAML module. This includes web applications accepting YAML configuration files, API endpoints that parse YAML payloads, CI/CD systems, and any service that deserializes YAML input from users or external systems. The lack of input validation on package and symbol names in perl/glob documents is the root cause, and the design of the YAML module's code-loading feature (disabled by default but globally toggleable via package variables) provides the escalation path to code execution. No authentication or special privileges are required to trigger the vulnerability if the attacker can reach a YAML parsing endpoint.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker identifies an application or service that accepts YAML input from an untrusted source and uses the affected Perl YAML module (versions before 1.27_001). This could be a web API endpoint, a configuration upload feature, or a message queue consumer. The attacker may probe for YAML parsing behavior by submitting benign YAML documents and observing responses or errors.

2. Triggering the flaw class: The attacker crafts a YAML document containing a perl/glob entry that targets the YAML package and the LoadCode or UseCode symbol, setting it to a true value. This document is submitted to the application, causing the vulnerable Load() call to assign the value to the package variable. After this step, code loading is enabled for all subsequent Load() calls in the same process. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The attacker does not need to know internal function names or file paths, only the package and symbol names that control the YAML module's behavior, which are standard and documented.

3. Payload/execution method: In a separate request or interaction, the attacker submits a second YAML document containing a perl/code entry with arbitrary Perl code. Because $YAML::LoadCode or $YAML::UseCode is now true, the YAML module passes the code to a string eval, executing it in the context of the application. The attacker can use this to run system commands, read files, establish persistence, or pivot to other systems. The code execution occurs with the privileges of the application process.

4. Post-exploitation impact: Successful exploitation grants the attacker arbitrary code execution as the application user. The attacker can exfiltrate sensitive data, install backdoors, move laterally within the network, or cause denial of service. Depending on the application's privileges, the attacker may escalate to full system compromise. The two-stage nature allows the attacker to separate the enabling step from the execution step, potentially evading simple detection that only inspects single requests.

Impact Assessment

The CVSS 3.1 base score is N/A as provided, but the vulnerability class and mechanism indicate a critical severity. The attack vector is network (AV:N) because YAML input is often transmitted over the network. Complexity is low (AC:L) as the attack requires only standard YAML documents. No privileges (PR:N) or user interaction (UI:N) are required. The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H) because arbitrary code execution allows full control over the application and potentially the host. The blast radius includes any application using the affected YAML module to parse untrusted input. In enterprise environments, this could affect configuration management systems, API gateways, and CI/CD pipelines, leading to widespread compromise. The lack of a patch increases the risk, as no official fix is available.

Detection Guidance

Sigma Rule

title: Perl YAML Perl/Glob Document Attempt to Modify Package Variables
id: 3f8a2b1c-9d4e-4f7a-8c1b-2e5f6a7b8c9d
status: experimental
description: Detects YAML documents containing perl/glob entries that attempt to set YAML::LoadCode or YAML::UseCode, indicating CVE-2019-25777 exploitation.
author: Threat Intelligence
date: 2025-04-09
logsource:
  category: application
  product: perl_yaml
detection:
  selection_glob:
    yaml_content|contains:
      - 'perl/glob'
      - 'YAML::LoadCode'
      - 'YAML::UseCode'
  selection_code:
    yaml_content|contains:
      - 'perl/code'
  condition: selection_glob or selection_code
falsepositives:
  - Legitimate use of perl/glob in trusted YAML files
level: critical
tags:
  - attack.t1190
  - cve.2019.25777

YARA Rule

rule CVE_2019_25777_Perl_YAML_Glob_Code_Execution
{
    meta:
        description = "Detects YAML documents attempting to exploit CVE-2019-25777 via perl/glob or perl/code"
        author = "Threat Intelligence"
        date = "2025-04-09"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2019-25777"
        severity = "critical"
    strings:
        $glob = "perl/glob"
        $code = "perl/code"
        $loadcode = "YAML::LoadCode"
        $usecode = "YAML::UseCode"
    condition:
        any of ($glob, $code) and any of ($loadcode, $usecode)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2019-25777 Perl YAML perl/glob Code Execution Attempt"; flow:to_server,established; content:"perl/glob"; http_client_body; nocase; content:"YAML::LoadCode"; http_client_body; nocase; distance:0; within:100; sid:1000001; rev:1; reference:cve,2019-25777; classtype:attempted-admin;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name == "perl" and process.args : "*YAML*"]
  [process where event.type == "start" and process.name == "perl" and process.args : "*eval*" and process.args : "*perl/code*"]

Splunk SPL Query

index=* sourcetype=perl:yaml OR sourcetype=app:yaml
| search "perl/glob" OR "perl/code" OR "YAML::LoadCode" OR "YAML::UseCode"
| stats count by host, source, user
| where count > 0

Wazuh OSSEC Rule

<group name="perl_yaml_cve_2019_25777,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="yaml_content">perl/glob|perl/code|YAML::LoadCode|YAML::UseCode</field>
    <description>CVE-2019-25777: Potential Perl YAML code execution attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2019_25777,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable YAML parsing of untrusted input wherever possible. If YAML parsing is required, ensure that the perl/glob and perl/code document types are rejected by the application before reaching the YAML module.
   • Implement input validation to block YAML documents containing perl/glob or perl/code tags.
   • Run Perl applications that parse YAML with the lowest possible privileges to limit the impact of code execution.
   • Use network segmentation and restrict access to YAML-parsing endpoints to trusted sources only.
   • Monitor for signs of exploitation using the detection rules provided.

2. Patch/upgrade steps:

   • The NVD description references version 1.27_001 as the threshold beyond which the vulnerability is fixed. However, no official patch or advisory is available from tracked sources. Administrators should check the official Perl YAML module repository or CPAN for any updates beyond 1.27_001 and apply them if available.
   • If no patch is available, consider migrating to an alternative YAML parsing library that does not support perl/glob or perl/code document types, or that safely restricts variable assignment.
   • Contact the vendor or maintainer for a patch timeline; this CVE is considered unpatched as of the latest intelligence.

3. Long-term hardening:

   • Adopt a secure-by-default configuration for YAML parsing: never enable code loading or unrestricted variable assignment from untrusted sources.
   • Implement a policy of parsing YAML in a sandboxed or isolated environment to contain potential code execution.
   • Conduct regular security audits of all applications that deserialize YAML, and enforce strict input validation.
   • Monitor CVE databases and vendor advisories for updates to CVE-2019-25777 and apply patches promptly once released.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2019-25777
• Perl YAML Module on CPAN: https://metacpan.org/pod/YAML
• CWE-502: Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No known threat actor campaigns or exploit-in-the-wild evidence available for this CVE.