CVE-2021-38305

Vulnerability

Yamale before version 3.0.8 uses Python's eval() function to process schema definitions. Although it attempts to restrict builtins, a crafted schema can bypass these restrictions and execute arbitrary code [1][2]. Affected versions: all prior to 3.0.8.

Exploitation

An attacker can create a malicious YAML schema file containing conditional expressions that break out of the restricted builtins sandbox. When Yamale processes this schema, the attacker's payload is evaluated, leading to arbitrary code execution [1][2]. No authentication is required if the attacker can supply the schema file (e.g., via a download or upload).

Impact

Successful exploitation allows remote code execution on the system running Yamale, with the privileges of the Yamale process. This can lead to full compromise of the affected application or service [1][2]. The vulnerability is in the schema parser, so any application using Yamale to validate schemas from untrusted sources is at risk.

Mitigation

Update to Yamale version 3.0.8, which addresses the issue by restricting the eval context more securely [3]. Users should avoid processing schemas from untrusted sources. No known workarounds. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as per the advisory [4].