Perl YAML Arbitrary Code Execution via DESTROY Method

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2017-20285 exploits a critical flaw in Perl's YAML module (versions before 1.30) where untrusted YAML documents can trigger arbitrary code execution through object deserialization. When a YAML document contains a perl/hash:Class tag, it blesses a hash into an attacker-specified class. As the object goes out of scope, Perl automatically invokes the DESTROY method of that class—a destructor commonly used for cleanup operations like file deletion. An attacker who can control YAML input can abuse DESTROY implementations (such as File::Temp::Dir's directory deletion logic) to execute arbitrary operations on the system. This vulnerability affects any Perl application that parses untrusted YAML data, making it particularly dangerous in web applications, configuration management tools, and data processing pipelines where YAML is the input format.

Casky's security skills mapped to MITRE ATT&CK detect the attack patterns underlying this vulnerability across three key adversary tactics. Under Initial Access (TA0001), skills identify suspicious YAML document structures with perl/hash tags that deviate from legitimate schemas. Execution (TA0002) skills detect the runtime behavior signatures of DESTROY method invocation chains and unusual class instantiation patterns during YAML deserialization. Persistence & Defense Evasion (TA0043) skills recognize how attackers craft YAML payloads to remain dormant until object destruction occurs, evading static analysis. Running Claude AI with extended reasoning across Casky's 447 matched skills, practitioners would see findings that correlate YAML parsing operations with unexpected system calls (file deletion, directory traversal, process spawning), flag Perl class instantiation from untrusted input sources, and identify DESTROY method triggers on user-controlled objects—enabling defenders to pinpoint vulnerable code paths and malicious YAML payloads before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2017-20285.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2017-20285

Casky has 447 skills that investigate the attack patterns behind CVE-2017-20285. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn