CVE-2021-41110 CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker
Attackers can achieve complete system takeover via unsafe YAML deserialization in CWL Viewer, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41110?
CVE-2021-41110 is a critical unsafe deserialization vulnerability in common-workflow-language cwlviewer, published on 1 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.
Weakness: CWE-502
Which versions are affected by CVE-2021-41110?
It affects 1 product.
Products include Commonwl Cwlviewer.
How do I fix CVE-2021-41110?
No fix has been published for CVE-2021-41110 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-41110 being exploited?
There is no known exploitation of CVE-2021-41110 in the wild and no public exploit code.
Sources
Also known as GHSA-7g7j-f5g3-fqp7.