CVE-2021-41078: Arbitrary Code Execution in nameko
Summary
CVE-2021-41078: Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file. Affects nameko versions < 2.14.0. Fixed in 2.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Nameko is a Python microservices framework that allows developers to easily build and deploy microservices-based applications. It provides features such as service discovery, RPC communication, and event-driven architecture. However, versions up to 2.13.0 of Nameko are vulnerable to arbitrary code execution when deserializing the config file.
Vulnerability Detail
The vulnerability in Nameko (CVE-2021-41078) allows an attacker to execute arbitrary code by manipulating the config file during deserialization. This can lead to remote code execution, enabling the attacker to take control of the affected system. The vulnerability arises due to improper input validation and insecure deserialization practices.
How To Fix
Minimum fixed version
2.14.0
This is the first release that contains the fix.
pip install --upgrade "nameko==2.14.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to avoid deserializing untrusted config files. Instead, manually parse and validate the config data to ensure its integrity before using it within the application. Here is an example of how to manually parse a config file in Python:
import json
with open('config.json', 'r') as file:
config_data = json.load(file)
# Validate and use the config data
Conclusion
The vulnerability (CVE-2021-41078) in Nameko allows for arbitrary code execution during config file deserialization. Upgrading to Nameko version 2.14.0 or later is the recommended solution. In the meantime, it is advised to follow the provided workaround and manually validate config data. For further assistance with vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nameko →
FAQ
Nameko is a Python microservices framework that simplifies the development and deployment of microservices-based applications. It provides features such as service discovery, RPC communication, and event-driven architecture.
CVE-2021-41078 allows an attacker to execute arbitrary code by manipulating the config file during deserialization. This can lead to remote code execution and potential compromise of the affected system.
To fix the vulnerability, upgrade to Nameko version 2.14.0 or later. This version includes security enhancements that prevent the execution of arbitrary code during config file deserialization.
Yes, versions up to 2.13.0 of Nameko are affected by CVE-2021-41078. It is recommended to upgrade to the fixed version to mitigate the vulnerability.
As a temporary workaround, avoid deserializing untrusted config files. Manually parse and validate the config data before using it within the application to ensure its integrity.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
