PT-2020-4065 · Jw · Jw.Util

Published 2020-05-22 · Updated 2023-03-03 · CVE-2020-13388

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: jw.util versions prior to 2.3

Description: The issue is related to errors in processing YAML files when loading configuration, allowing a remote attacker to execute arbitrary operating system commands. This is due to the lack of safe load when loading configurations with FromString or FromStream using YAML, enabling the execution of arbitrary Python code.

Recommendations: For versions prior to 2.3, update to version 2.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of FromString or FromStream with YAML until a patch is available. Restrict access to configuration-loading functionality to minimize the risk of exploitation. Avoid using YAML for configuration loading in the affected versions until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-04465

CVE-2020-13388

GHSA-H72C-W3Q3-55QQ

PYSEC-2020-341

Affected Products

Jw.Util

References · 11

• 🔥 https://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability · Exploit
• 🔥 https://joel-malwarebenchmark.github.io · Exploit
• https://osv.dev/vulnerability/PYSEC-2020-341 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13388 · Security Note
• https://osv.dev/vulnerability/GHSA-h72c-w3q3-55qq · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04465 · Security Note
• https://security.netapp.com/advisory/ntap-20200528-0002 · Note
• https://github.com/advisories/GHSA-h72c-w3q3-55qq · Note
• https://t.me/cvenotify/45441 · Telegram Post
• https://t.me/cibsecurity/12303 · Telegram Post