Strix
26.1K

CVE-2021-38305

HIGHCVSS 7.8/10EPSS 2.49%

Last modified

CVE-2021-38305 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. EPSS estimates a 2.49% chance of exploitation in the next 30 days.

Description

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
2.49%

82.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
23andmeYamale< 3.0.8

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-38305?
23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.
How severe is CVE-2021-38305?
CVE-2021-38305 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 2.49% probability of exploitation in the next 30 days.
How do I fix CVE-2021-38305?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-38305?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST