CVE-2021-23727: OS Command Injection in celery
Summary
CVE-2021-23727: OS Command Injection in celery. Affects celery versions < 5.2.2. Fixed in 5.2.2. How to fix ↓
Also tracked for
- celery · Debian:11
The same CVE-2021-23727 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Celery is a distributed task queue system for Python that allows you to run tasks asynchronously. It is commonly used in web applications to handle time-consuming tasks in the background. Celery relies on backends (result stores) to store task metadata and messages. These backends are trusted by default, which can lead to a vulnerability if an attacker gains access to or manipulates the metadata within a celery backend.
Vulnerability Detail
The vulnerability in celery (before version 5.2.2) arises from the default trust placed on the messages and metadata stored in backends. When reading task metadata from the backend, the data is deserialized. An attacker who can access or manipulate the metadata within a celery backend can exploit this by triggering a stored command injection vulnerability. This can potentially allow the attacker to execute arbitrary commands and gain further access to the system.
How To Fix
Minimum fixed version
5.2.2
This is the first release that contains the fix.
pip install --upgrade "celery==5.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of celery is not immediately feasible, you can mitigate the risk by ensuring that the celery backend is not accessible to untrusted entities. Restricting access to the backend and implementing proper authentication and authorization mechanisms can help prevent unauthorized access and manipulation of the metadata.
Conclusion
In conclusion, the vulnerability in celery (CVE-2021-23727) allows for OS command injection if an attacker gains access to or manipulates the metadata within a celery backend. Upgrading to celery version 5.2.2 or later is recommended to fix this vulnerability. If immediate upgrade is not possible, restricting access to the backend and implementing proper security measures can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for celery →
FAQ
Celery is a distributed task queue system for Python that allows you to run tasks asynchronously. It is commonly used in web applications to handle time-consuming tasks in the background.
A command injection vulnerability occurs when an attacker is able to inject malicious commands into a system that is then executed by the application. In the case of celery, the vulnerability allows an attacker to execute arbitrary commands by manipulating the metadata within a celery backend.
If exploited, this vulnerability can allow an attacker to execute arbitrary commands on the affected system. This can lead to unauthorized access, data theft, or further compromise of the system.
Yes, upgrading to celery version 5.2.2 or later fixes this vulnerability. It is recommended to update to the latest version as soon as possible.
If upgrading to the latest version is not immediately feasible, you can mitigate the risk by ensuring that the celery backend is not accessible to untrusted entities. Implementing proper access controls and authentication mechanisms can help prevent unauthorized access and manipulation of the metadata.
Related vulnerabilities
Recent vulnerabilities recorded for celery.
