CVE-2021-23727

Celery < 5.2.2 allows command injection via backend metadata manipulation

• CVSS 7.5
• CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
• Input Validation and Sanitization
• Remote

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

CVE

CVE-2021-23727

CWE

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVSS base score

7.5

Published

2021-12-29

OWASP

A03 Injection

Orthogonal defect classification

Timing/Serialization

Code defect classification

Serialization Issues

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Celery to version 5.2.2 or higher.

from celery import Celery

app = Celery('tasks', broker='pyamqp://guest@localhost//', backend='rpc://')

@app.task
def add(x, y):
    return x + y

def get_task_result(task_id):
    result = AsyncResult(task_id)
    return result.result

if __name__ == "__main__":
    task = add.delay(4, 6)
    print(get_task_result(task.id))

from celery import Celery
from celery.result import AsyncResult
import json

app = Celery('tasks', broker='pyamqp://guest@localhost//', backend='rpc://')

@app.task
def add(x, y):
    return x + y

def get_task_result(task_id):
    result = AsyncResult(task_id)
    try:
        return json.loads(result.result)
    except (ValueError, TypeError) as e:
        return None

if __name__ == "__main__":
    task = add.delay(4, 6)
    print(get_task_result(task.id))

@misc{vaitp:cve202123727,
  title        = {{Celery < 5.2.2 allows command injection via backend metadata manipulation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-23727},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-23727/}}
}