Geladenes Databook von Tablib anfällig für Python-Einfügung, was zu Befehlsausführung führt

The impact of CVE-2017-2810 is severe. An attacker can craft a malicious YAML Databook file that, when loaded by Tablib, will execute arbitrary Python commands on the system. This effectively grants the attacker complete control over the affected machine. The attack surface is broad, as any application or service utilizing Tablib to process YAML Databooks is potentially vulnerable. This vulnerability shares similarities with other deserialization vulnerabilities where untrusted data is processed without proper validation, potentially leading to code execution. The blast radius extends to any data accessible to the compromised system.

Applications and systems that utilize Tablib version 0.11.4 or earlier, particularly those that process user-supplied YAML Databook files, are at significant risk. This includes systems that integrate with data processing pipelines or applications that handle external data sources in YAML format. Shared hosting environments where multiple applications share the same Tablib installation are also particularly vulnerable.

• python / system:

Get-Process | Where-Object {$_.ProcessName -like '*python*'} | Select-Object Name, Id, Path

• python / file: Check for suspicious YAML files in locations where Databooks are processed. Look for embedded Python code or unusual YAML structures. • python / log: Monitor Python application logs for errors related to YAML parsing or execution. • generic web: If Tablib is exposed via a web application, check for unusual file uploads or requests containing YAML content.

1. 2017-07-13Disclosure

   disclosure

2. 2017-07-13Patch

   patch

1. Veröffentlicht2018-07-13
2. Geändert2024-12-07
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2017-2810 is to upgrade Tablib to version 0.11.5 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing input validation to sanitize YAML Databook files before processing them. Specifically, restrict the allowed keys and data types within the YAML file. Additionally, consider using a safer YAML parser that provides better protection against code execution vulnerabilities. After upgrading, confirm the fix by attempting to load a known malicious YAML file (in a safe, isolated environment) and verifying that it no longer executes arbitrary code.