CVE-2017-16764

YAML parsing in Django_make_app 0.1.3 allows arbitrary Python command execution

• CVSS 9.8
• CWE-502: Deserialization of Untrusted Data
• Input Validation and Sanitization
• Local

An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.

CVE

CVE-2017-16764

CWE

CWE-502: Deserialization of Untrusted Data

CVSS base score

9.8

Published

2017-11-10

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update django_make_app to version 0.1.4 or higher.

import yaml

def read_yaml_file(file_path):
    """Vulnerable function that demonstrates the security issue."""
    with open(file_path, 'r') as file:
        return yaml.load(file, Loader=yaml.FullLoader)

import yaml

def read_yaml_file(file_path):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents deserialization
    with open(file_path, 'r') as file:
        return yaml.load(file)

@misc{vaitp:cve201716764,
  title        = {{YAML parsing in Django_make_app 0.1.3 allows arbitrary Python command execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2017-16764},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2017-16764/}}
}