CVE-2021-43811 Code injection via unsafe YAML loading
Attackers can execute arbitrary code by tricking users into running a Sockeye model with a maliciously crafted YAML configuration file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-43811?
CVE-2021-43811 is a high-severity code injection vulnerability in awslabs sockeye, published on 8 Dec 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.
Weakness: CWE-94
Which versions are affected by CVE-2021-43811?
3 open source packages ship an affected version, including sockeye. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sockeye PyPI | All versions | 2.3.24 |
sockeye PyPI | All versions | 2.3.24 |
sockeye PyPI | All versions | 2.3.24 |
Products include Amazon Sockeye.
How do I fix CVE-2021-43811?
Upgrade sockeye to 2.3.24 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-43811 being exploited?
There is no known exploitation of CVE-2021-43811 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-ggmr-44cv-24pm, PYSEC-2021-848.