django_make_app is vulnerable to Code Injection

The impact of CVE-2017-16764 is severe due to its potential for remote code execution. An attacker who can upload or modify a YAML file processed by django-make-app can inject arbitrary Python code. This code will be executed with the privileges of the user running the application, potentially granting the attacker full control over the server. This could involve data theft, system compromise, or even using the server as a launchpad for further attacks. The vulnerability's ease of exploitation, combined with the potential for widespread deployment of django-make-app, makes it a significant security risk. While no widespread exploitation has been publicly reported, the availability of a proof-of-concept significantly increases the likelihood of future attacks.

Web applications and services that utilize django-make-app, particularly those that allow user-supplied YAML files to be processed without proper validation, are at significant risk. Development environments and staging servers running vulnerable versions are also prime targets.

• python / server:

Get-Process -Name python | Where-Object {$_.Path -like '*django-make-app*'} | Select-Object ProcessId, CommandLine

• python / server:

Get-ChildItem -Path 'C:\path\to\django-make-app\io_utils.py' -Recurse -Filter '*read_yaml_file*'

• generic web: Examine access logs for requests containing suspicious YAML payloads or unusual file extensions. • generic web: Check for unusual processes running under the Python interpreter.

1. 2018-07-13Disclosure

   disclosure

1. Publicada2018-07-13
2. Modificada2025-02-16
3. EPSS atualizado2026-04-02

The primary mitigation for CVE-2017-16764 is to upgrade to a patched version of django-make-app. Unfortunately, no official patched version has been released. As a workaround, carefully validate all YAML files before processing them. Implement strict input validation to prevent the injection of malicious code. Consider using a safer YAML parser that is less susceptible to code execution vulnerabilities. Additionally, restrict access to the YAML files to only authorized users and processes. After implementing these mitigations, verify their effectiveness by attempting to load a known malicious YAML file (in a safe, isolated environment) to ensure that the code is not executed.