CVE-2021-38305

Arbitrary code execution in 23andMe Yamale (before 3.0.8)

• CVSS 7.8
• CWE-434
• Input Validation and Sanitization
• Remote

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.

CVE

CVE-2021-38305

CWE

CWE-434

CVSS base score

7.8

Published

2021-08-09

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update 23andMe Yamale to version 3.0.8 or higher

def process_schema(schema_lines):
    """Vulnerable function that demonstrates the security issue."""
    builtins = {'__builtins__': {'print': print}}
    for line in schema_lines:
        try:
            result = eval(line, builtins)
        except Exception as e:
            print(f"Error processing line '{line}': {e}")

schema = [
    "1 + 2",          
    "'hello'.upper()", 
    "__import__('os').system('ls')" 
]

process_schema(schema)

import ast

def modified_eval(expr):
    """Secure function that fixes the vulnerability."""
    node = ast.parse(expr, mode='eval')

    for n in ast.walk(node):
        if not isinstance(n, (ast.Expression, ast.Num, ast.Str, ast.List, ast.Dict, ast.Tuple, ast.Name, ast.BinOp, ast.UnaryOp, ast.Compare, ast.Call)):
            raise ValueError("Unsafe expression detected")

    return ast.literal_eval(compile(node, '<string>', mode='eval'))

def process_schema(schema_lines):
    """Secure function that fixes the vulnerability."""
    for line in schema_lines:
        try:
            result = modified_eval(line)
        except Exception as e:
            print(f"Error processing line '{line}': {e}")

schema = [
    "1 + 2",          
    "'hello'.upper()", 
    "__import__('os').system('ls')"
]

process_schema(schema)

@misc{vaitp:cve202138305,
  title        = {{Arbitrary code execution in 23andMe Yamale (before 3.0.8)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-38305},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-38305/}}
}