Databook carregado do Tablib suscetível à inserção python resultando em execução de comando

The impact of CVE-2017-2810 is severe. An attacker can craft a malicious YAML Databook file that, when loaded by a vulnerable Tablib instance, will execute arbitrary Python code on the system. This effectively grants the attacker complete control over the affected machine. The attacker could install malware, steal sensitive data, modify system configurations, or use the compromised system as a launchpad for further attacks. This vulnerability shares similarities with other YAML deserialization vulnerabilities where malicious payloads can be embedded within seemingly harmless data files.

Applications and systems that utilize Tablib version 0.11.4 or earlier, particularly those that process user-supplied YAML Databook files, are at significant risk. This includes systems that integrate with data processing pipelines or applications that handle external data sources in YAML format. Shared hosting environments where multiple applications share the same Tablib installation are also particularly vulnerable.

• python / system:

Get-Process | Where-Object {$_.ProcessName -like '*python*'} | Select-Object Name, Id, Path

• python / file: Check for suspicious YAML files in locations where Databooks are processed. Look for embedded Python code or unusual YAML structures. • python / log: Monitor Python application logs for errors related to YAML parsing or execution. • generic web: If Tablib is exposed via a web application, check for unusual file uploads or requests containing YAML content.

1. 2017-07-13Disclosure

   disclosure

2. 2017-07-13Patch

   patch

1. Publicada2018-07-13
2. Modificada2024-12-07
3. EPSS atualizado2026-04-02

The primary mitigation for CVE-2017-2810 is to upgrade to Tablib version 0.11.5 or later, which addresses the vulnerability. If upgrading immediately is not feasible, consider implementing strict input validation on Databook files to prevent the inclusion of potentially malicious code. While not a complete solution, restricting file access and permissions can limit the potential damage. Monitor system logs for unusual Python process activity or unexpected file modifications. If possible, implement a Web Application Firewall (WAF) to filter out malicious YAML payloads before they reach the Tablib application.