VulnerabilityModified
CVE-2017-16763
An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0.
CRITICAL 9.8EPSS 4.47%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "~/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 4.47% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- confire project/confire
- Source
- cve@mitre.org
References
- https://github.com/bbengfort/confire/commit/8cc86a5ec2327e070f1d576d61bbaadf861597eaPatch, Third Party Advisory
- https://github.com/bbengfort/confire/issues/24Exploit, Third Party Advisory
- https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16763-configure-loaded-through-confire/Exploit, Third Party Advisory
- https://github.com/bbengfort/confire/commit/8cc86a5ec2327e070f1d576d61bbaadf861597eaPatch, Third Party Advisory
- https://github.com/bbengfort/confire/issues/24Exploit, Third Party Advisory
- https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16763-configure-loaded-through-confire/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.