CVE-2021-43857 Gerapy may contain remote code execution vulnerability
Attackers can execute arbitrary code on servers running the Gerapy distributed crawler management framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43857?
CVE-2021-43857 is a critical command injection vulnerability in Gerapy, published on 27 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.
Weakness: CWE-78
Which versions are affected by CVE-2021-43857?
3 open source packages ship an affected version, including gerapy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gerapy PyPI | All versions | 0.9.8 |
gerapy PyPI | All versions | 0.9.8 |
gerapy PyPI | All versions | 0.9.8 |
Products include Gerapy Gerapy.
How do I fix CVE-2021-43857?
Upgrade gerapy to 0.9.8 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-43857 being exploited?
There is no known exploitation of CVE-2021-43857 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 5 proofs of concept on GitHub.
Other vulnerabilities in Gerapy
Sources
Also known as CVE-2021-44597, GHSA-9w7f-m4j4-j3xw, PYSEC-2021-867.