Puppet 不正确的输入验证漏洞

攻击者可以利用此漏洞通过 Puppet REST API 发送恶意构造的 YAML 数据，触发反序列化过程。由于 Puppet 在反序列化过程中允许实例化任意 Ruby 类，攻击者可以执行任意代码，从而完全控制受影响的系统。这可能导致数据泄露、系统被破坏、甚至整个基础设施的瘫痪。该漏洞的潜在影响类似于其他利用反序列化漏洞的攻击，例如 Log4Shell，攻击者可以利用它来获取系统权限并进行横向移动。

Organizations heavily reliant on Puppet for configuration management are at significant risk. This includes environments with complex infrastructure, sensitive data, and a large number of managed nodes. Legacy Puppet deployments, particularly those running older versions due to compatibility constraints, are especially vulnerable. Shared hosting environments where multiple users share a Puppet master instance are also at increased risk.

• ruby / server:

ps aux | grep puppet

Check the Puppet version running using puppet --version. If it's below 2.7.22, the system is vulnerable. • ruby / supply-chain: Review Puppet modules and code for any custom deserialization routines that might be vulnerable to similar attacks. • generic web: Monitor Puppet master server logs for unusual REST API requests or errors related to YAML parsing.

1. 2013-07-15Discovery

   discovery

2. 2017-10-24Disclosure

   disclosure

3. 2017-10-24Patch

   patch

1. 发布日期2017-10-24
2. 修改日期2024-11-29
3. EPSS 更新日期2026-04-02

最有效的缓解措施是立即将 Puppet 升级至 2.7.22 或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：限制对 Puppet REST API 的访问，仅允许受信任的客户端进行访问。实施严格的输入验证，过滤掉潜在的恶意 YAML 数据。使用 Web 应用防火墙 (WAF) 或代理服务器来检测和阻止包含恶意 YAML 负载的请求。在 Puppet 配置中禁用不必要的模块和功能，以减少攻击面。