CVE-2019-7537: Donfig 0.3.0 - Arbitrary Command Execution
Summary
CVE-2019-7537: An issue was discovered in Donfig 0.3.0. Affects donfig versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Donfig is a Python package available on PyPI that provides configuration management functionality. It allows users to collect YAML files and access their contents programmatically. The package is vulnerable to an arbitrary command execution vulnerability in the collect_yaml method of the config_obj.py file. This vulnerability can be exploited to execute arbitrary Python commands, potentially leading to unauthorized command execution.
Vulnerability Detail
The vulnerability in Donfig 0.3.0 arises from a lack of proper input validation in the collect_yaml method. An attacker can provide malicious YAML files containing specially crafted Python commands. When these files are processed, the commands are executed within the context of the application, allowing the attacker to execute arbitrary code. This can result in unauthorized access, data manipulation, or even complete compromise of the affected system.
How To Fix
Minimum fixed version
0.4.0
This is the first release that contains the fix.
pip install --upgrade "donfig==0.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the functionality that processes YAML files until the package is updated. This can be achieved by modifying the application code to skip the collect_yaml method or by removing any references to it. However, it is strongly recommended to apply the official fix as soon as possible.
Conclusion
Donfig version 0.3.0 is vulnerable to arbitrary command execution. Users should upgrade to version 0.4.0 or later to mitigate this vulnerability. In the meantime, disabling the processing of YAML files can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for donfig →
FAQ
The vulnerability allows an attacker to execute arbitrary Python commands within the context of the affected application. This can lead to unauthorized access, data manipulation, or complete compromise of the system.
No, only Donfig version 0.3.0 is affected. Versions 0.4.0 and later include the necessary fixes to mitigate this vulnerability.
Yes, this vulnerability can be exploited remotely if the affected application is exposed to untrusted input from external sources, such as user-supplied YAML files.
There is no evidence of active exploitation of this vulnerability at the time of this advisory. However, it is recommended to apply the fix as soon as possible to prevent any potential attacks.
No, a CVSS score has not been assigned to this vulnerability at the time of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for donfig.
