CVE-2011-4212
The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a dev_appserver.RestrictedPathFunction._original_os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.23% probability · 14th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- google/app engine python sdk
- Source
- cve@mitre.org
References
- http://blog.watchfire.com/files/googleappenginesdk.pdfExploit
- http://code.google.com/p/googleappengine/wiki/SdkReleaseNotesPatch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71063
- http://blog.watchfire.com/files/googleappenginesdk.pdfExploit
- http://code.google.com/p/googleappengine/wiki/SdkReleaseNotesPatch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71063
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.