CVE-2017-16764: django-make-app YAML Parsing Arbitrary Command Execution
Summary
CVE-2017-16764: An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. Affects django-make-app versions >= 0.1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
django-make-app is a package available on PyPI that provides functionality for creating Django applications. It allows users to generate the basic structure and files required for a Django app. The package is vulnerable to an arbitrary command execution vulnerability in its YAML parsing functionality.
Vulnerability Detail
The vulnerability exists in the read_yaml_file method in io_utils.py in django-make-app version 0.1.3. The YAML parser used by the package can be tricked into executing arbitrary Python commands, leading to command execution. An attacker can exploit this vulnerability by inserting malicious Python code into loaded YAML files. This can result in unauthorized remote code execution and potential compromise of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a fixed version of django-make-app to mitigate the risk of exploitation.
Conclusion
The YAML parsing functionality in django-make-app version 0.1.3 is vulnerable to arbitrary command execution. To mitigate this risk, users should update to a non-vulnerable version, such as 0.1.4 or later. It is crucial to keep software dependencies up to date to ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for django-make-app →
FAQ
django-make-app is a package that helps in creating Django applications by generating the necessary files and structure.
This vulnerability allows an attacker to execute arbitrary Python commands, potentially leading to remote code execution and compromise of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
Yes, the maintainers of django-make-app have released a fix in version 0.1.4. It is recommended to update to this version or any subsequent non-vulnerable releases.
There are no known workarounds for this vulnerability. Updating to a fixed version of django-make-app is the recommended solution.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
