cve/2024/CVE-2024-42363.md

### [CVE-2024-42363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42363)
![](https://img.shields.io/static/v1?label=Product&message=Samson&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%203385%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%3A%20Deserialization%20of%20Untrusted%20Data&color=brighgreen)

### Description

Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse_file method where it is unsafely deserialized using the YAML.load_stream method. This issue may lead to Remote Code Execution (RCE). This vulnerability is fixed in 3385.

### POC

#### Reference
- https://securitylab.github.com/advisories/GHSL-2023-136_Samson/

#### Github
No PoCs found on GitHub currently.