(Remote)Code-Execution while loading yaml-file

The list of possible sources for suricata-update is downloaded from "https://www.openinfosecfoundation.org/rules/index.yaml" per default. Suricata-Update uses the insecure yaml.load()-function. Code will be executed if the yaml-file contains lines like:

hello: !!python/object/apply:os.system ['ls -l > /tmp/output']

The vulnerable function can be triggered by "suricata-update list-sources". The locally stored index.yaml will be loaded in this function and the malicious code gets executed.

This commit fixes Bug #2359

diff --git a/suricata/update/config.py b/suricata/update/config.py
index dc912e436fa9b2ead63255bdeeedf16eab8df21d..36970400fd4ccfc6ef8bcb7f9d667679f4ce5ed3 100644 (file)
--- a/suricata/update/config.py
+++ b/suricata/update/config.py
@@ -133,13 +133,13 @@ def init(args):
     if args.config:
         logger.info("Loading %s", args.config)
         with open(args.config, "rb") as fileobj:
-            config = yaml.load(fileobj)
+            config = yaml.safe_load(fileobj)
             if config:
                 _config.update(config)
     elif os.path.exists(DEFAULT_UPDATE_YAML_PATH):
         logger.info("Loading %s", DEFAULT_UPDATE_YAML_PATH)
         with open(DEFAULT_UPDATE_YAML_PATH, "rb") as fileobj:
-            config = yaml.load(fileobj)
+            config = yaml.safe_load(fileobj)
             if config:
                 _config.update(config)
 

diff --git a/suricata/update/sources.py b/suricata/update/sources.py
index 083edf7452ec3c77fe8f4e0cb757c07b09539492..ac64ce1a459a17fc4e989e0dc41d8e72f9703c25 100644 (file)
--- a/suricata/update/sources.py
+++ b/suricata/update/sources.py
@@ -96,7 +96,7 @@ class Index:
         self.reload()
 
     def reload(self):
-        index = yaml.load(open(self.filename, "rb"))
+        index = yaml.safe_load(open(self.filename, "rb"))
         self.index = index
 
     def resolve_url(self, name, params={}):
@@ -128,7 +128,7 @@ def get_enabled_sources():
         for filename in filenames:
             if filename.endswith(".yaml"):
                 path = os.path.join(dirpath, filename)
-                source = yaml.load(open(path, "rb"))
+                source = yaml.safe_load(open(path, "rb"))
                 sources[source["source"]] = source
 
                 if "params" in source: