OISF suricata-update unsafely deserializes YAML data
Date: 2022-05
Affected: pip/suricata-update
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2018-1000167
CWE: CWE-502
CVSS: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Suricata-Update uses the insecure `yaml.load()` function. Code will be executed if the yaml-file contains lines like: ```yaml hello: !!python/object/apply:os.system ['ls -l > /tmp/output'] ``` The vulnerable function can be triggered by "suricata-update list-sources". The locally stored index.yaml will be loaded in this function and the malicious code gets executed.


Mitigations:

Architectural layers (MAESTRO):