CVE-2021-24040
published 2021-09-10CVE-2021-24040: Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting…
PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
17.35%
96.7th percentile
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parlai | < 1.1.0 | 1.1.0 | |
| parlai | < 4374fa2aba383db6526ab36e939eb1cf8ef99879 | 4374fa2aba383db6526ab36e939eb1cf8ef99879 | |
| parlai | >= 0 < 1.1.0 | 1.1.0 | |
| parlai | >= 0 < 507d066ef432ea27d3e201da08009872a2f37725 | 507d066ef432ea27d3e201da08009872a2f37725 | |
| parlai | >= unspecified < 1.1.0 | 1.1.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor calls to 'parlai.chat_service.utils.config.parse_configuration_file()' with externally-supplied or user-writable YAML files, as this is the vulnerable code path exploited. ↗
- →Alert on YAML configuration files containing '__import__' or 'os.system' strings, which indicate attempted code injection via PyYAML unsafe load. ↗
- ·The vulnerability requires an attacker to have write access to local YAML configuration files used by ParlAI; it is not directly remotely exploitable without this prerequisite. ↗
- ·Only ParlAI versions prior to v1.1.0 are affected; upgrading to v1.1.0 or later mitigates this issue. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Deserialization of Untrusted Data in parlai
osv·2021-09-13
CVE-2021-24040 [MEDIUM] Deserialization of Untrusted Data in parlai
Deserialization of Untrusted Data in parlai
### Impact
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.
### Patches
The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls.
### References
- https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
- https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
- https://anon-artist.github.io/blogs/blog3.html
OSV
Deserialization of Untrusted Data in ParlAI
osv·2021-09-13
CVE-2021-24040 [MEDIUM] Deserialization of Untrusted Data in ParlAI
Deserialization of Untrusted Data in ParlAI
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
GHSA
Deserialization of Untrusted Data in ParlAI
ghsa·2021-09-13
CVE-2021-24040 [MEDIUM] CWE-502 Deserialization of Untrusted Data in ParlAI
Deserialization of Untrusted Data in ParlAI
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
OSV
CVE-2021-24040: Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input,
osv·2021-09-10
CVE-2021-24040 CVE-2021-24040: Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input,
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
OSV
CVE-2021-24040: parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets
osv·2021-09-10
CVE-2021-24040 CVE-2021-24040: parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.htmlhttps://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgghttp://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.htmlhttps://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
2021-09-10
Published