CVE-2021-23727: Command Injection Vulnerability in Celery
Summary
CVE-2021-23727: This affects the package celery before 5.2.2. Affects celery versions < 5.2.2. Fixed in 5.2.2. How to fix ↓
Also tracked for
- celery · Debian:11
The same CVE-2021-23727 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Celery is a distributed task queue system for Python that allows you to run tasks asynchronously across multiple workers. It is commonly used for handling background tasks in web applications. The package provides a backend storage mechanism for storing task metadata and results. However, prior to version 5.2.2, Celery did not properly validate the data stored in the backend, making it vulnerable to command injection attacks.
Vulnerability Detail
The vulnerability in Celery arises from the default trust given to messages and metadata stored in backends. When reading task metadata from the backend, the data is deserialized without proper validation. This means that if an attacker gains access to or manipulates the metadata within a Celery backend, they can trigger a stored command injection vulnerability. By injecting malicious commands, an attacker could potentially gain unauthorized access to the system and perform further malicious actions.
How To Fix
Minimum fixed version
5.2.2
This is the first release that contains the fix.
pip install --upgrade "celery==5.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Celery is not immediately feasible, a possible workaround is to implement additional input validation and sanitization when reading task metadata from the backend. This can help prevent the execution of malicious commands. Here is an example of how you can sanitize the metadata using the shlex module in Python:
import shlex
metadata = get_metadata_from_backend()
sanitized_metadata = shlex.quote(metadata)
Conclusion
The command injection vulnerability in Celery can allow an attacker to execute arbitrary commands and potentially gain unauthorized access to the system. It is crucial to upgrade to Celery version 5.2.2 or later to mitigate this risk. If immediate upgrade is not possible, implementing input validation and sanitization can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for celery →
FAQ
Celery is a distributed task queue system for Python that allows you to run tasks asynchronously across multiple workers. It is commonly used for handling background tasks in web applications.
A command injection vulnerability occurs when an attacker is able to inject malicious commands into a system, which are then executed by the application. This can lead to unauthorized access, data leakage, and other malicious activities.
An attacker can exploit this vulnerability by gaining access to or manipulating the metadata stored in a Celery backend. By injecting malicious commands into the metadata, they can trick the system into executing those commands, potentially gaining unauthorized access and performing further malicious actions.
Yes, this vulnerability has been fixed in Celery version 5.2.2. It is recommended to upgrade to this version or later to mitigate the risk of command injection attacks.
If upgrading to the latest version of Celery is not immediately feasible, you can implement additional input validation and sanitization when reading task metadata from the backend. This can help prevent the execution of malicious commands.
References
Related vulnerabilities
Recent vulnerabilities recorded for celery.
