PT-2017-14498 · Owlmixin · Owlmixin

Joel · Published 2017-11-08 · Updated 2019-10-03 · CVE-2017-16618

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OwlMixin versions prior to 2.0.0a12

Description The issue exists in the YAML loading functionality of util.py, where a "Load YAML" string or file can execute arbitrary Python commands. This is due to the use of load instead of safe load, allowing an attacker to insert Python into loaded YAML and trigger command execution.

Recommendations For versions prior to 2.0.0a12, update to version 2.0.0a12 or later to resolve the issue. As a temporary workaround, consider disabling the load yaml and load yamlf functions in util.py until a patch is available. Restrict access to YAML loading functionality to minimize the risk of exploitation. Avoid using the load function for YAML loading; instead, use the safe load function to prevent arbitrary command execution.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-16618

GHSA-CCMQ-QVCP-5MRM

PYSEC-2017-22

Affected Products

Owlmixin

References · 10

• 🔥 https://github.com/tadashi-aikawa/owlmixin/issues/12 · Exploit
• 🔥 https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16618-convert-through-owlmixin · Exploit
• https://github.com/tadashi-aikawa/owlmixin/commit/5d0575303f6df869a515ced4285f24ba721e0d4e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-16618 · Security Note
• https://osv.dev/vulnerability/GHSA-ccmq-qvcp-5mrm · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-22 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16618 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/owlmixin/PYSEC-2017-22.yaml · Note
• https://github.com/tadashi-aikawa/owlmixin · Note
• https://github.com/advisories/GHSA-ccmq-qvcp-5mrm · Note