PT-2017-14498 · Owlmixin · Owlmixin

Joel · Publicado 2017-11-08 · Atualizado 2019-10-03 · CVE-2017-16618

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OwlMixin versions prior to 2.0.0a12

Description The issue exists in the YAML loading functionality of util.py, where a "Load YAML" string or file can execute arbitrary Python commands. This is due to the use of load instead of safe load, allowing an attacker to insert Python into loaded YAML and trigger command execution.

Recommendations For versions prior to 2.0.0a12, update to version 2.0.0a12 or later to resolve the issue. As a temporary workaround, consider disabling the load yaml and load yamlf functions in util.py until a patch is available. Restrict access to YAML loading functionality to minimize the risk of exploitation. Avoid using the load function for YAML loading; instead, use the safe load function to prevent arbitrary command execution.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-16618

GHSA-CCMQ-QVCP-5MRM

PYSEC-2017-22

Produtos afetados

Owlmixin

Referências · 10

• 🔥 https://github.com/tadashi-aikawa/owlmixin/issues/12 · Exploit
• 🔥 https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16618-convert-through-owlmixin · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/owlmixin/PYSEC-2017-22.yaml · Nota
• https://github.com/tadashi-aikawa/owlmixin/commit/5d0575303f6df869a515ced4285f24ba721e0d4e · Correção
• https://github.com/tadashi-aikawa/owlmixin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16618 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-ccmq-qvcp-5mrm · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-22 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16618 · Aviso do Fabricante
• https://github.com/advisories/GHSA-ccmq-qvcp-5mrm · Nota