Project

General

Profile

Actions

Bug #2359

closed

(Remote)Code-Execution while reading yaml-file

Added by Wolfgang Hotwagner almost 4 years ago. Updated almost 4 years ago.

Status:
Closed
Priority:
Urgent
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The list of possible sources for suricata-update is downloaded from "https://www.openinfosecfoundation.org/rules/index.yaml" per default. Suricata-Update uses the insecure yaml.load()-function. Code will be executed if the yaml-file contains lines like:


hello: !!python/object/apply:os.system ['ls -l > /tmp/output']

The vulnerable function can be triggered by "suricata-update list-sources". The locally stored index.yaml will be loaded in this function and the malicious code gets executed.

Actions #1

Updated by Jason Ish almost 4 years ago

  • Target version set to 1.0.0b1
Actions #2

Updated by Jason Ish almost 4 years ago

  • Status changed from New to Closed
Actions

Also available in: Atom PDF