CVE-2013-2217: Medium severity Jeff Ortel Suds vulnerability
cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
Other sources
python-suds creates and uses some sort of cache in /tmp/suds. It appears to make no attempt to check that the cache is not created or modified by a different user.
After running a SOAP request using suds, I notice the /tmp/suds directory. I chown'd -R /tmp/suds to a different user, and chmod'd -R 777.
Then stracing the script sending soap requests with python-suds, and I see:
stat("/tmp/suds/suds-3359686402328425149-document.px", {stmode=SIFREG|0777, open("/tmp/suds/suds-3359686402328425149-document.px", ORDONLY) = 3 read(3, "\200\2(csuds.sax.document\nDocument\nq"..., 4096) = 4096
[I note that even if python-suds were inspecting the stat result at some later point to check user & permissions, and reading-but-ignoring the contents of the /tmp file there would still be a toq-tau race.]
I haven't verified the details, but presumably if you know what SOAP services another user is using, you can then create a /tmp/suds/ directory to do nasty things to them. [For instance the SOAP .wsdl metadata can redirect queries to a different host.]
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/suds-py3to a version that resolves this vulnerability.Fixed in 1.4.4.1 - Upgrade
Upgrade
pip/sudsto a version that resolves this vulnerability.Fixed in 1.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2217?
CVE-2013-2217 is classified as a moderate severity vulnerability due to its potential for local exploitation.
How do I fix CVE-2013-2217?
To fix CVE-2013-2217, upgrade to the latest version of Suds or Suds-Py3, specifically version 1.4.4.1 or higher.
What systems are affected by CVE-2013-2217?
CVE-2013-2217 affects Suds versions up to 0.4 and is relevant for certain versions of openSUSE and Red Hat Enterprise Linux.
What does CVE-2013-2217 exploit?
CVE-2013-2217 can be exploited through a symlink attack targeting a cache file created in the /tmp/suds/ directory.
Can CVE-2013-2217 be exploited remotely?
No, CVE-2013-2217 is a local vulnerability and requires access to the affected system to exploit.