N/A

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.

N/A

N/A

23andMe Yamale 代码问题漏洞

23andMe Yamale是开源的YAML 的架构和验证器。 23andMe Yamale 存在代码问题漏洞，该漏洞源于在3.0.8版本之前的23andMe Yamale中模式解析器使用eval作为其处理的一部分，并试图通过限制传递给eval的内置函数来防止恶意表达式，在处理模式时，每一行都通过Python的eval函数运行，以使验证器可用，其中在架构规则中构造良好的字符串可以执行系统命令。攻击者可利用该漏洞在调用Yamale的映像上运行任意代码。

N/A

N/A