PT-2011-4886 · Google · Google App Engine Python Sdk

Published 2011-10-30 · Updated 2019-04-10 · CVE-2011-4213

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google App Engine Python SDK versions prior to 1.5.4

Description The issue is related to the sandbox environment in the Google App Engine Python SDK, which does not properly restrict the use of the os module. This allows local users to bypass access restrictions and execute arbitrary commands. The exploitation occurs via a file blob storage.os reference within the code parameter to the "/ ah/admin/interactive/execute" API endpoint.

Recommendations For versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the ah/admin/interactive/execute API endpoint to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-4213

Affected Products

Google App Engine Python Sdk

References · 4

• 🔥 http://blog.watchfire.com/files/googleappenginesdk.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4213 · Security Note
• http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71062 · Note