CVE-2017-2810: Command Execution in Tablib
Summary
CVE-2017-2810: An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. Affects tablib versions < 0.11.5. Fixed in 0.11.5. How to fix ↓
Also tracked for
- python-tablib · Debian:11
The same CVE-2017-2810 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tablib is a Python library that provides a way to manipulate tabular data. It allows users to load, manipulate, and export data in various formats such as CSV, JSON, and YAML. The Databook loading functionality in Tablib version 0.11.4 is vulnerable to command execution due to improper handling of loaded YAML data. This vulnerability allows an attacker to insert malicious Python code into loaded YAML, leading to arbitrary command execution.
Vulnerability Detail
The vulnerability (CVE-2017-2810) arises from the insecure handling of YAML data in Tablib's Databook loading functionality. When a YAML file is loaded, the library fails to properly sanitize the input, allowing an attacker to inject arbitrary Python code. This code is then executed within the context of the application, potentially leading to unauthorized access, data manipulation, or other malicious activities. The impact of this vulnerability depends on the privileges and functionality of the application using Tablib.
How To Fix
Minimum fixed version
0.11.5
This is the first release that contains the fix.
pip install --upgrade "tablib==0.11.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid loading untrusted YAML files using Tablib's Databook loading functionality. Instead, they can manually parse and sanitize the YAML data before passing it to Tablib. Here's an example of how to load YAML data using the PyYAML library and then convert it to a Tablib Databook:
import yaml
import tablib
with open('data.yaml', 'r') as file:
yaml_data = yaml.safe_load(file)
databook = tablib.Databook()
for sheet_name, sheet_data in yaml_data.items():
dataset = tablib.Dataset()
dataset.headers = sheet_data['headers']
dataset.extend(sheet_data['rows'])
databook.add_sheet(dataset, title=sheet_name)
Conclusion
In conclusion, Tablib version 0.11.4 is vulnerable to command execution due to improper handling of loaded YAML data. This vulnerability (CVE-2017-2810) can be mitigated by upgrading to Tablib version 0.11.5 or later. Alternatively, users can follow the provided workaround to manually parse and sanitize YAML data before using Tablib's Databook loading functionality. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tablib →
FAQ
The impact of this vulnerability depends on the privileges and functionality of the application using Tablib. In worst-case scenarios, an attacker could execute arbitrary commands within the application's context, leading to unauthorized access, data manipulation, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities, including CVE-2017-2810.
Yes, a fix is available in Tablib version 0.11.5 or later. Upgrading to the latest version of Tablib will address this vulnerability by properly sanitizing loaded YAML data.
As a temporary workaround, you can avoid loading untrusted YAML files using Tablib's Databook loading functionality. Instead, manually parse and sanitize the YAML data before passing it to Tablib.
There are no known instances of this vulnerability being exploited in the wild. However, it is recommended to apply the fix or workaround as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for tablib.
