CVE-2021-39132 YAML deserialization can run untrusted code

What is CVE-2021-39132?

CVE-2021-39132 is a high-severity unsafe deserialization vulnerability in rundeck, published on 30 Aug 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14

Weakness: CWE-502

Which versions are affected by CVE-2021-39132?

4 open source packages ship an affected version, including org.rundeck:rundeck-core. It affects 1 product.

Products include Pagerduty Rundeck.

How do I fix CVE-2021-39132?

Upgrade org.rundeck:rundeck-core to a fixed version for your release line: 3.3.14 or 3.4.3.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-39132 being exploited?

There is no known exploitation of CVE-2021-39132 in the wild and no public exploit code.

Other vulnerabilities in rundeck

• CVE-2022-29186 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise Critical 9.1
• CVE-2023-48222 Authenticated users can view or delete jobs they do not have authorization for in Rundeck High 8.1
• CVE-2021-41112 Missing Authorization in Rundeck High 8.1
• CVE-2022-31044 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation High 7.5
• CVE-2021-39133 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q4rf-3fhx-88pf.