Miggo Logo

CVE-2016-4972: OpenStack Murano Code Execution

9.8

CVSS Score
3.0

Basic Information

EPSS Score
0.87796%
Published
5/17/2022
Updated
10/25/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
muranopip< 1.0.31.0.3
murano-dashboardpip< 1.0.31.0.3
python-muranoclientpip< 0.7.30.7.3
murano-dashboardpip>= 2.0.0, < 2.0.12.0.1
python-muranoclientpip>= 0.8.0, < 0.8.50.8.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from using PyYAML's unsafe Loader and Constructor classes, which parse YAML with full object deserialization capabilities. The commit diff shows the fix replaced yaml.Loader with yaml.SafeLoader and yaml.constructor.Constructor with SafeConstructor. The original classes in yaql_yaml_loader.py directly inherited from these unsafe bases, making them the root cause. The YAML parsing in MuranoPL and UI files used these vulnerable loaders, allowing attackers to exploit extended YAML tags for code execution.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Op*nSt**k Mur*no ***or* *.*.* (li**rty) *n* *.x ***or* *.*.* (mit*k*), Mur*no-**s**o*r* ***or* *.*.* (li**rty) *n* *.x ***or* *.*.* (mit*k*), *n* pyt*on-mur*no*li*nt ***or* *.*.* (li**rty) *n* *.*.x ***or* *.*.* (mit*k*) improp*rly us* lo***rs in**ri

Reasoning

T** vuln*r**ility st*ms *rom usin* PyY*ML's uns*** Lo***r *n* *onstru*tor *l*ss*s, w*i** p*rs* Y*ML wit* *ull o*j**t **s*ri*liz*tion **p**iliti*s. T** *ommit *i** s*ows t** *ix r*pl**** y*ml.Lo***r wit* y*ml.S***Lo***r *n* y*ml.*onstru*tor.*onstru*to