Stored Command Injection

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A

celery 命令注入漏洞

celery是开源的一个用于分布式任务队列的包。 celery 5.2.2之前版本存在安全漏洞，该漏洞源于软件缺少防护机制，信任存储在后端（结果存储）中的消息和元数据。 从后端读取任务元数据时，数据被反序列化。 鉴于攻击者可以访问或以某种方式操纵 celery 后端中的元数据，他们可能会触发存储命令注入漏洞并有可能进一步访问系统。

N/A

N/A