PT-2021-22026 · 23Andme · Yamale
Mildebrandt
·
Published
2021-08-09
·
Updated
2021-10-07
·
CVE-2021-38305
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
23andMe Yamale versions prior to 3.0.8
Description:
The issue allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands, thus allowing an attacker to run arbitrary code on the image that invokes Yamale.
Recommendations:
For versions prior to 3.0.8, update to version 3.0.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of the schema parser or limiting access to the eval function until a patch is applied. Avoid using crafted schema files that can execute system commands until the issue is resolved.
Fix
Unrestricted File Upload
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Yamale