kedro-org/kedro · Security
Kedro allows Remote Code Execution by Pulling Micro Packages
- GHSA ID
- GHSA-rm69-wvpv-r2w7
- CVE ID
- CVE-2024-12215
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
In kedro-org/kedro version 0.19.8, the pull_package() API function allows users to download and extract micro packages from the Internet. However, the function project_wheel_metadata() within the code path can execute the setup.py file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
CWEs
- CWE-20 · Improper Input Validation
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
- CWE-829 · Inclusion of Functionality from Untrusted Control Sphere