CVE-2023-47204

Unsafe YAML deserialization in transmute-core before 1.13.5 in yaml.Loader

• CVSS 9.8
• CWE-502 Deserialization of Untrusted Data
• Input Validation and Sanitization
• Local

Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.

CVE

CVE-2023-47204

CWE

CWE-502 Deserialization of Untrusted Data

CVSS base score

9.8

Published

2023-11-02

OWASP

A03 Injection

Orthogonal defect classification

Timing/Serialization

Code defect classification

Serialization Issues

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update transmute-core to version 1.13.5 or later

import yaml

def load_yaml(yaml_string):
    return yaml.load(yaml_string, Loader=yaml.Loader)

yaml_data = """
!!python/object/apply:os.system ['echo Hello, World!']
"""

result = load_yaml(yaml_data)

import yaml

def load_yaml(yaml_string):
    return yaml.safe_load(yaml_string)

yaml_data = """
!!python/object/apply:os.system ['echo Hello, World!']
"""

try:
    result = load_yaml(yaml_data)
except Exception as e:
    print(f"Error: {e}")

@misc{vaitp:cve202347204,
  title        = {{Unsafe YAML deserialization in transmute-core before 1.13.5 in yaml.Loader}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-47204},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-47204/}}
}