CVE-2017-16763 (published 2017-11-10T09:29Z)

An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "~/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/bbengfort/confire
commit_details: repo_url: https://github.com/bbengfort/confire
author: Benjamin Bengfort
author_date: 2017-11-11 10:20:25-05:00
msg: use safe load instead of load
repository: repo_url: https://github.com/bbengfort/confire
repo_name: bbengfort/confire
description: A simple app configuration scheme using YAML and class based defaults.
repo_language: Python
owner: bbengfort
file_changes: filename: config.py
change_type: ModificationType.MODIFY
diff: @@ -143,7 +143,7 @@ class Configuration(with_metaclass(SettingsMeta, object)):
         for path in klass.CONF_PATHS:
             if os.path.exists(path):
                 with open(path, 'r') as conf:
-                    config.configure(yaml.load(conf))
+                    config.configure(yaml.safe_load(conf))
         return config
 
     def configure(self, conf={}):

programming_language: Python
filename: test_conf.py
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-# tests.conf_tests
+# tests.test_conf
 # Testing the configuration module for Confire
 #
 # Author:   Benjamin Bengfort <benjamin@bengfort.com>
@@ -7,7 +7,7 @@
 # Copyright (C) 2014 Bengfort.com
 # For license information, see LICENSE.txt
 #
-# ID: conf_tests.py [] benjamin@bengfort.com $
+# ID: test_conf.py [] benjamin@bengfort.com $
 
 """
 Testing the configuration module for Confire

programming_language: Python
filename: test_descriptors.py
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-# tests.descriptors_tests
+# tests.test_descriptors
 # Implements a base SettingsDescriptor for advanced configurations
 #
 # Author:   Benjamin Bengfort <benjamin@bengfort.com>
@@ -7,7 +7,7 @@
 # Copyright (C) 2015 Bengfort.com
 # For license information, see LICENSE.txt
 #
-# ID: descriptors_tests.py [] benjamin@bengfort.com $
+# ID: test_descriptors.py [] benjamin@bengfort.com $
 
 """
 Implements a base SettingsDescriptor for advanced configurations

programming_language: Python
filename: test_environ.py
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-# tests.environ_tests
+# tests.test_environ
 # Tests the environment configuration ability
 #
 # Author:   Benjamin Bengfort <benjamin@bengfort.com>
@@ -7,7 +7,7 @@
 # Copyright (C) 2014 Bengfort.com
 # For license information, see LICENSE.txt
 #
-# ID: environ_tests.py [] benjamin@bengfort.com $
+# ID: test_environ.py [] benjamin@bengfort.com $
 
 """
 Tests the environment configuration ability

programming_language: Python
filename: test_paths.py
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-# tests.paths_tests
+# tests.test_paths
 # Testing the paths descriptor
 #
 # Author:   Benjamin Bengfort <benjamin@bengfort.com>
@@ -7,7 +7,7 @@
 # Copyright (C) 2014 Bengfort.com
 # For license information, see LICENSE.txt
 #
-# ID: paths_tests.py [] benjamin@bengfort.com $
+# ID: test_paths.py [] benjamin@bengfort.com $
 
 """
 Testing the paths descriptor

programming_language: Python
filename: test_safety.py
change_type: ModificationType.ADD
diff: @@ -0,0 +1,40 @@
+# tests.test_safety
+# Test that we're using safe methods
+#
+# Author:   Benjamin Bengfort <benjamin@bengfort.com>
+# Created:  Fri Nov 10 12:22:35 2017 -0500
+#
+# Copyright (C) 2014 Bengfort.com
+# For license information, see LICENSE.txt
+#
+# ID: test_safety.py [] benjamin@bengfort.com $
+
+"""
+Testing the paths descriptor
+"""
+
+##########################################################################
+## Imports
+##########################################################################
+
+import os
+
+from unittest import mock
+
+
+# Cannot import from test_conf.py to ensure correct mock
+TESTDATA = os.path.join(os.path.dirname(__file__), "testdata")
+TESTCONF = os.path.join(TESTDATA, "testconf.yaml")
+
+
+@mock.patch('confire.config.yaml')
+def test_use_yaml_safe_load(mock_yaml):
+    """
+    Ensure we're using yaml.safe_load not yaml.load
+    """
+    from confire.config import Configuration
+    Configuration.CONF_PATHS = [TESTCONF]
+    Configuration.load()
+
+    mock_yaml.safe_load.assert_called_once()
+    mock_yaml.load.assert_not_called()

programming_language: Python