CVE-2018-17175: Vulnerability in marshmallow
Summary
CVE-2018-17175: In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to inst... Affects marshmallow across 2 version ranges.
< 2.15.1
>= 3.0a0, < 3.0.0b9
Fixed in 2.15.1 or 3.0.0b9, depending on the release line you run. How to fix ↓
Also tracked for
- python-marshmallow · Debian:11
The same CVE-2018-17175 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
marshmallow is a Python library used for object serialization and deserialization. It provides a simple way to convert complex data types, such as objects, to and from Python data types. The library is widely used in web development frameworks and APIs. However, versions before 2.15.1 and 3.x before 3.0.0b9 of marshmallow are vulnerable to a security issue.
Vulnerability Detail
The vulnerability in marshmallow arises from the way the schema "only" option is handled. When an empty list is provided as the "only" option, it is mistakenly interpreted as no "only" option, resulting in all fields being exposed. This can occur when the schema is dynamically filtered using the "only" option and a user role produces an empty value for "only". As a consequence, a request that was intended to expose no fields may inadvertently expose all fields, potentially leading to unauthorized access or information disclosure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.15.12.15.1pip install --upgrade "marshmallow==2.15.1" -
>= 3.0a0, < 3.0.0b93.0.0b9pip install --upgrade "marshmallow==3.0.0b9"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by manually checking the "only" option for an empty list and treating it as intended. This can be achieved by adding a validation step in the code that dynamically filters the schema using the "only" option. Here is an example in Python:
only_option = request.user.role.get_only_option()
if only_option == []:
only_option = None
schema = MySchema(only=only_option)
In this example, if the user role produces an empty list for the "only" option, it is replaced with None to ensure no fields are exposed.
Conclusion
In conclusion, the vulnerability in marshmallow allows unintended exposure of fields when an empty list is used as the "only" option. To mitigate this issue, it is crucial to update to a fixed version of marshmallow or apply the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for marshmallow →
FAQ
marshmallow is a Python library used for object serialization and deserialization. It provides a simple way to convert complex data types, such as objects, to and from Python data types.
Versions before 2.15.1 and 3.x before 3.0.0b9 of marshmallow are affected by this vulnerability.
The vulnerability can potentially lead to unauthorized access or information disclosure. A request that was intended to expose no fields may inadvertently expose all fields.
To fix this vulnerability, it is recommended to upgrade to a fixed version of marshmallow. Users of version 2.x should update to version 2.15.1 or later, while users of version 3.x should update to version 3.0.0b9 or later.
Yes, if upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by manually checking the "only" option for an empty list and treating it as intended.
References
Related vulnerabilities
Recent vulnerabilities recorded for marshmallow.
