CVE-2017-16764: Code Injection in django-make-app
Summary
CVE-2017-16764: django_make_app is vulnerable to Code Injection. Affects django-make-app versions < 0.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
django-make-app is a package available on PyPI that provides functionality for creating Django applications. It includes a YAML parsing functionality in the read_yaml_file method in io_utils.py. This package is vulnerable to a code injection vulnerability, allowing an attacker to execute arbitrary Python commands by inserting malicious code into loaded YAML files.
Vulnerability Detail
The vulnerability exists in the YAML parsing functionality of django-make-app. By manipulating the loaded YAML file, an attacker can inject Python code, which will be executed by the YAML parser. This can lead to arbitrary command execution on the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is advised to avoid loading YAML files from untrusted sources or to thoroughly validate the content of the YAML file before parsing it. Additionally, implementing input sanitization and validation can help mitigate the risk of code injection attacks.
Conclusion
In conclusion, django-make-app is vulnerable to a code injection vulnerability that allows arbitrary Python command execution. It is crucial to update the package to a patched version and follow best practices for secure YAML parsing. For further assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for django-make-app →
FAQ
django-make-app is a package that provides functionality for creating Django applications.
This vulnerability allows an attacker to execute arbitrary Python commands, potentially leading to unauthorized access, data manipulation, or system compromise.
To fix this vulnerability, update django-make-app to a patched version that addresses the code injection issue.
As a workaround, avoid loading YAML files from untrusted sources and validate the content of the YAML file before parsing it.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
