CVE-2023-36467

AWS data.all 1.2.0 to 1.5.1: Remote code execution by authenticated users in 'Template' field

• CVSS 8.8
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around.

CVE

CVE-2023-36467

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

8.8

Published

2023-06-28

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to data.all version 1.5.2 or higher.

def configure_data_pipeline(template):
    """Vulnerable function that demonstrates the security issue."""
    exec(template)


user_input_template = "print('Executing arbitrary code!')"
configure_data_pipeline(user_input_template)

import re

BLACKLIST = ['exec', 'import', 'os', 'sys', 'subprocess', 'eval']

def sanitize_template(template):
    """Secure function that fixes the vulnerability."""
    allowed_pattern = re.compile(r'^[\w\s{}]+$')
    if not allowed_pattern.match(template):
        raise ValueError("Invalid template: contains unsafe characters.")
    for blacklisted_command in BLACKLIST:
        if blacklisted_command in template:
            raise ValueError(f"Template contains blacklisted command: {blacklisted_command}")
    return template

def configure_data_pipeline(template):
    """Secure function that fixes the vulnerability."""
    sanitized_template = sanitize_template(template)
    exec(sanitized_template)

try:
    user_input_template = "print('Executing arbitrary code!')"
    configure_data_pipeline(user_input_template)
except ValueError as e:
    print(e)

@misc{vaitp:cve202336467,
  title        = {{AWS data.all 1.2.0 to 1.5.1: Remote code execution by authenticated users in 'Template' field}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-36467},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-36467/}}
}