PT-2021-15661 · Parlai · Parlai

Anon-Artist · Published 2021-09-10 · Updated 2021-09-24 · CVE-2021-24040

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ParlAI versions prior to 1.1.0

Description: Due to the use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue allows attackers to exploit the vulnerability by modifying local YAML configuration files.

Recommendations: For versions prior to 1.1.0, upgrade to v1.1.0 or later to patch the issue. As a temporary workaround, replace YAML deserialization with equivalent safe load calls. Consider changing the Loader used to SafeLoader to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-24040

GHSA-M87F-9FVV-2MGG

GHSA-MWGJ-7X7J-6966

PYSEC-2021-330

PYSEC-2021-334

Affected Products

Parlai

References · 21

• 🔥 http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html · Exploit
• 🔥 https://exploit-db.com/exploits/50289 · Exploit
• https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-24040 · Security Note
• https://osv.dev/vulnerability/GHSA-mwgj-7x7j-6966 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39207 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-330 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m87f-9fvv-2mgg · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-334 · Vendor Advisory
• https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0 · Note
• https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725 · Note
• https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879 · Note
• https://github.com/facebookresearch/ParlAI/pull/3402 · Note
• https://github.com/facebookresearch/ParlAI · Note