PT-2021-4272 · Unknown+1 · Manuskript+1

Pizza Power · Published 2021-06-21 · Updated 2024-08-04 · CVE-2021-35196

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Manuskript versions 0.12.0 and earlier

Description The issue is related to insecure deserialization via the pickle.load() function in settings.py, allowing remote attackers to execute arbitrary code by crafting a settings.pickle file in a project file. This could potentially lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. The vendor's position is that the product is not intended for opening untrusted project files.

Recommendations For Manuskript versions 0.12.0 and earlier, consider disabling the pickle.load() function in settings.py as a temporary workaround until a patch is available. Restrict access to untrusted project files to minimize the risk of exploitation. Avoid using the pickle.load() function with untrusted data until the issue is resolved.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2021-04880

CVE-2021-35196

Affected Products

Debian

Manuskript

References · 11

• 🔥 https://pizzapower.me/2021/06/20/arbitrary-code-execution-in-manuskript-0-12 · Exploit
• https://bdu.fstec.ru/vul/2021-04880 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-35196 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-35196 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-35196 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35196 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-35196 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-35196 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35196 · Vendor Advisory
• https://github.com/olivierkes/manuskript/issues/891 · Note
• https://t.me/cvenotify/88873 · Telegram Post