CVE-2011-4104

Django Tastypie < 0.9.10: Remote code execution via YAML deserialization

• CVSS 7.5
• CWE-20 Improper Input Validation
• Input Validation and Sanitization
• Local

The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

CVE

CVE-2011-4104

CWE

CWE-20 Improper Input Validation

CVSS base score

7.5

Published

2014-10-27

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Django Tastypie to version 0.9.10 or higher.

import pickle

def load_data(data):
    """Load data - VULNERABLE to pickle RCE"""
    # VULNERABILITY: pickle.loads can execute arbitrary code
    return pickle.loads(data)

# Malicious payload can execute system commands
# when unpickled

import json

def load_data_secure(data):
    """Securely load data using JSON"""
    try:
        # SECURE: JSON only allows safe data types
        return json.loads(data)
    except json.JSONDecodeError:
        return None
    except Exception:
        return None

@misc{vaitp:cve20114104,
  title        = {{Django Tastypie < 0.9.10: Remote code execution via YAML deserialization}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2014},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2011-4104},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2011-4104/}}
}