CVE-2021-32807: AccessControl - Remote Code Execution Vulnerability
Summary
CVE-2021-32807: The module AccessControl defines security policies for Python code used in restricted code within Zope applications. Affects accesscontrol across 3 version ranges.
>= 4.0, < 4.3
>= 5.0, < 5.2
< b42dd4badf803bb9fb71ac34cd9cb0c249262f2c
Fixed in 4.3 or 5.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-32807 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AccessControl is a module that defines security policies for Python code used in restricted code within Zope applications. It restricts access to Python modules, allowing only a few safe ones. However, a vulnerability in AccessControl versions 4 and 5 on Python 3 allows an attacker to override and extend the Formatter class within Script (Python) objects, providing access to unsafe Python libraries. This can lead to remote code execution. The vulnerability affects sites that allow untrusted users to add/edit scripts through the web.
Vulnerability Detail
The vulnerability in AccessControl versions 4 and 5 on Python 3 allows an attacker to override and extend the Formatter class within Script (Python) objects, providing access to unsafe Python libraries. By exploiting this, an attacker can execute arbitrary code remotely. The vulnerability only affects sites that allow untrusted users to add/edit scripts through the web. AccessControl versions 4.3 and 5.2 have fixed this issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.34.3pip install --upgrade "accesscontrol==4.3" -
>= 5.0, < 5.25.2pip install --upgrade "accesscontrol==5.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, site administrators can restrict adding/editing Script (Python) objects through the web by using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role, and adding/editing these scripts through the web should be restricted to trusted users only.
Conclusion
The vulnerability in AccessControl versions 4 and 5 on Python 3 allows for remote code execution. It is crucial to upgrade to AccessControl version 4.3 or 5.2 to mitigate this vulnerability. Site administrators should also restrict adding/editing Script (Python) objects through the web to trusted users only. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for accesscontrol →
FAQ
AccessControl versions 4 and 5 on Python 3 are affected. Python 2.7 is not vulnerable.
The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to a complete compromise of the affected system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will analyze it for vulnerabilities.
Yes, site administrators can restrict adding/editing Script (Python) objects through the web to trusted users only as a workaround.
There is no known exploit available at the moment. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for accesscontrol.
