Code Execution Bug Affects Yamale Python Package — Used by Over 200 Projects

guest · Oct 8, 2021

Code Execution Bug Affects Yamale Python Package — Used by Over 200 Projects
October 7, 2021
https://thehackernews.com/2021/10/code-execution-bug-affects-yamale.html

A high-severity code injection vulnerability has been disclosed in 23andMe's Yamale, a schema and validator for YAML, that could be trivially exploited by adversaries to execute arbitrary Python code.

The flaw, tracked as CVE-2021-38305 (CVSS score: 7.8), involves manipulating the schema file provided as input to the tool to circumvent protections and achieve code execution. Particularly, the issue resides in the schema parsing function, which allows any input passed to be evaluated and executed, resulting in a scenario where a specially-crafted string within the schema can be abused for the injection of system commands.
Click to expand...

Yamale is a Python package that allows developers to validate YAML — a data serialization language often used for writing configuration files — from the command line. The package is used by at least 224 repositories on GitHub.

"This gap allows attackers that can provide an input schema file to perform Python code injection that leads to code execution with the privileges of the Yamale process," JFrog Security CTO Asaf Karas said in an emailed statement to The Hacker News.
"We recommend sanitizing any input going to eval() extensively and — preferably — replacing eval() calls with more specific APIs required for your task."
Click to expand...

Log in or Sign up

Code Execution Bug Affects Yamale Python Package — Used by Over 200 Projects

guest Guest

Log in or Sign up

Code Execution Bug Affects Yamale Python Package — Used by Over 200 Projects

guest Guest

Useful Searches