Security Fix for Arbitrary Code Execution - huntr.dev

[huntr-helper]

https://huntr.dev/users/d3m0n-r00t has fixed the Arbitrary Code Execution vulnerability 🔨. d3m0n-r00t has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
GitHub Issue | #14
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/pip/definitions/1/README.md

User Comments:

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-pip-definitions

⚙️ Description *

definitions loads and validates YAML definitions against a schema.
This package is vulnerable to Arbitrary Code Execution via. the load() method in definitions/parser.py. The parser is used to load yaml files using the unsafe load() method in pyyaml. This lead to code execution. Changed the unsafe load() to safer safe_load() thus eliminating code execution and safe loading of yaml files.

💻 Technical Description *

The definitions library can be used to load and validate yaml definitions against a schema. This package was vulnerable to Arbitrary code execution due to a use of a known vulnerable function load() in pyyaml.
The unsafe load() was changed to safe_load() in pyyaml which is the fix proposed by the author of pyyaml and instructs to use it in every project.

🐛 Proof of Concept (PoC) *

• Vulnerable code

     return yaml.load(file_)
return yaml.load(source)

• poc

from definitions import Parser
a = Parser._load('simple.yaml')
#'simple.yaml':!!python/object/apply:os.system ["touch HACKED"]

Referece: https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation

🔥 Proof of Fix (PoF) *

• Fixed code.

 return yaml.safe_load(file_)
return yaml.safe_load(source)

👍 User Acceptance Testing (UAT)

Before the fix the when running vulnerable code we can see a warning not to use the load() function. After the fix the loading runs smoothly without code execution or warnings
Fix referance: https://stackoverflow.com/questions/1773805/how-can-i-parse-a-yaml-file-in-python