Excessive Field Exposure in Python Marshmallow Library - CVE-2018-17175
Summary
CVE-2018-17175: In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to inst... Affects python-marshmallow across 2 version ranges.
< 3.0.0b14-1
< 251bff399786ad827d22c59f1cf4a49cc9aa9afe
Fixed in 3.0.0b14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Marshmallow library is a popular tool used for object serialization and deserialization, as well as for validating input data. It allows developers to define schemas for their data structures, making it easier to manage complex data types. However, a vulnerability was discovered in versions prior to 2.15.1 and 3.x before 3.0.0b9, where the 'only' option in schemas could be misconfigured, leading to unintended exposure of all fields instead of the intended limited fields.
Vulnerability Detail
CVE-2018-17175 arises from a flaw in the handling of the 'only' option within the Marshmallow library. When an empty list is provided for the 'only' option, it is treated as if no fields are specified, which can inadvertently expose all fields in a schema. This misconfiguration can lead to sensitive data being exposed to users who should not have access to it, especially if the schema is dynamically filtered based on user roles. The vulnerability affects multiple Debian ecosystems and can be exploited if the application relies on the flawed behavior of the library.
How To Fix
Minimum fixed version
3.0.0b14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-marshmallowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using an empty list for the 'only' option in your schemas. Instead, explicitly define the fields you want to expose, or use a default value that does not lead to exposing all fields. For example:
schema = MySchema(only=['field1', 'field2'])
This ensures that only the specified fields are accessible.
Conclusion
CVE-2018-17175 represents a significant risk for applications using the Marshmallow library, as it can lead to unintended data exposure. It is crucial for developers to upgrade to the fixed versions and implement best practices in schema design to mitigate this vulnerability.
See every vulnerability recorded for python-marshmallow →
FAQ
The vulnerability affects Marshmallow versions before 2.15.1 and 3.x before 3.0.0b9.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate upgrade is not possible, implement the suggested workaround by explicitly defining fields in your schemas to prevent unintended exposure.
More details can be found in the official CVE database and the Marshmallow GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for python-marshmallow.
