CVE-2024-35060

YAML library vulnerability in NASA AIT-Core v2.5.2 allows command execution.

• CVSS 7.5
• CWE-319
• Input Validation and Sanitization
• Local

An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file.

CVE

CVE-2024-35060

CWE

CWE-319

CVSS base score

7.5

Published

2024-05-21

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

YAML Python

Fixed by upgrading

Yes

Solution

Upgrade to NASA AIT-Core v2.5.3 or later.

import yaml

def load_yaml(file_path):
    with open(file_path, 'r') as file:
        data = yaml.load(file, Loader=yaml.FullLoader)
    return data

data = load_yaml('example.yaml')
print(data)

import yaml

def load_yaml(file_path):
    with open(file_path, 'r') as file:
        data = yaml.safe_load(file)
    return data

data = load_yaml('example.yaml')
print(data)

!!python/object/apply:os.system ["echo vulnerable"]

@misc{vaitp:cve202435060,
  title        = {{YAML library vulnerability in NASA AIT-Core v2.5.2 allows command execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-35060},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-35060/}}
}