PT-2021-23071 · Nameko · Nameko

Masatoshi Yoshizawa · Published 2021-10-19 · Updated 2021-10-29 · CVE-2021-41078

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Nameko versions prior to 2.14.0 Nameko versions v3.0.0rc0 through v3.0.0rc9

Description The issue allows for arbitrary code execution when deserializing the config file. This can be achieved by tricking Nameko into deserializing a malicious YAML config file. For example, a malicious.yaml file can contain code that executes system commands, such as import ('os').system('cat /etc/passwd'). This can lead to the execution of arbitrary system commands.

Recommendations For versions prior to 2.14.0, update to version 2.14.0 or later to resolve the issue. For versions v3.0.0rc0 through v3.0.0rc9, update to v3.0.0rc10 or later to resolve the issue. As a temporary workaround, consider only using config files that you trust to avoid exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-41078

GHSA-6P52-JR3Q-C94G

PYSEC-2021-383

Affected Products

Nameko

References · 10

• 🔥 https://github.com/nameko/nameko/security/advisories/GHSA-6p52-jr3q-c94g · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41078 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41078 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6p52-jr3q-c94g · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-383 · Vendor Advisory
• https://github.com/nameko/nameko · Note
• https://github.com/nameko/nameko/releases/tag/v3.0.0-rc10 · Note
• https://github.com/nameko/nameko/releases/tag/v2.14.0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nameko/PYSEC-2021-383.yaml · Note
• https://t.me/cibsecurity/31213 · Telegram Post