CVE-2021-38305 Command injection in Yamale
Remote attackers can execute arbitrary code via crafted schema files due to unsafe eval usage in the Yamale library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-38305?
CVE-2021-38305 is a high-severity code injection vulnerability in n/a, published on 9 Aug 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.
Weakness: CWE-434
Which versions are affected by CVE-2021-38305?
3 open source packages ship an affected version, including yamale. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yamale PyPI | All versions | 3.0.8 |
yamale PyPI | All versions | 3.0.8 |
yamale PyPI | All versions | 3.0.8 |
Products include 23andme Yamale.
How do I fix CVE-2021-38305?
Upgrade yamale to 3.0.8 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-38305 being exploited?
There is no known exploitation of CVE-2021-38305 in the wild and no public exploit code.
Sources
Also known as GHSA-435p-f82x-mxwm, PYSEC-2021-119.