PT-2017-14545 · Confire · Confire

Joel · Published 2017-11-10 · Updated 2019-10-03 · CVE-2017-16763

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Confire version 0.2.0

Description A vulnerability exists in the YAML parsing functionality due to the use of the yaml.load function to load user-specific configuration from ~/.confire.yaml. This allows a YAML parser to execute arbitrary Python commands, resulting in command execution. An attacker can exploit this by inserting Python code into loaded YAML.

Recommendations For Confire version 0.2.0, consider disabling the yaml.load function in config.py until a patch is available to prevent arbitrary command execution. Restrict access to the ~/.confire.yaml file to minimize the risk of exploitation. Avoid using the yaml.load function to load user-specific configuration files until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2017-16763

GHSA-M85C-9MF8-M2M6

PYSEC-2017-78

Affected Products

Confire

References · 10

• 🔥 https://github.com/bbengfort/confire/issues/24 · Exploit
• 🔥 https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16763-configure-loaded-through-confire · Exploit
• https://github.com/bbengfort/confire/commit/8cc86a5ec2327e070f1d576d61bbaadf861597ea · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-16763 · Security Note
• https://osv.dev/vulnerability/PYSEC-2017-78 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m85c-9mf8-m2m6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16763 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/confire/PYSEC-2017-78.yaml · Note
• https://github.com/bbengfort/confire · Note
• https://github.com/advisories/GHSA-m85c-9mf8-m2m6 · Note