PT-2011-4886 · Google · Google App Engine Python Sdk

Publicado 2011-10-30 · Atualizado 2019-04-10 · CVE-2011-4213

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google App Engine Python SDK versions prior to 1.5.4

Description The issue is related to the sandbox environment in the Google App Engine Python SDK, which does not properly restrict the use of the os module. This allows local users to bypass access restrictions and execute arbitrary commands. The exploitation occurs via a file blob storage.os reference within the code parameter to the "/ ah/admin/interactive/execute" API endpoint.

Recommendations For versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the ah/admin/interactive/execute API endpoint to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-4213

Produtos afetados

Google App Engine Python Sdk

Referências · 4

• 🔥 http://blog.watchfire.com/files/googleappenginesdk.pdf · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71062 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4213 · Nota de Segurança
• http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes · Correção