CVE-2013-2217: Medium severity suds by jeff ortel vulnerability
cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
Other sources
python-suds creates and uses some sort of cache in /tmp/suds. It appears to make no attempt to check that the cache is not created or modified by a different user.
After running a SOAP request using suds, I notice the /tmp/suds directory. I chown'd -R /tmp/suds to a different user, and chmod'd -R 777.
Then stracing the script sending soap requests with python-suds, and I see:
stat("/tmp/suds/suds-3359686402328425149-document.px", {stmode=SIFREG|0777, open("/tmp/suds/suds-3359686402328425149-document.px", ORDONLY) = 3 read(3, "\200\2(csuds.sax.document\nDocument\nq"..., 4096) = 4096
[I note that even if python-suds were inspecting the stat result at some later point to check user & permissions, and reading-but-ignoring the contents of the /tmp file there would still be a toq-tau race.]
I haven't verified the details, but presumably if you know what SOAP services another user is using, you can then create a /tmp/suds/ directory to do nasty things to them. [For instance the SOAP .wsdl metadata can redirect queries to a different host.]
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2217?
CVE-2013-2217 is classified as a moderate severity vulnerability due to its potential for local exploitation.
How do I fix CVE-2013-2217?
To fix CVE-2013-2217, upgrade to the latest version of Suds or Suds-Py3, specifically version 1.4.4.1 or higher.
What systems are affected by CVE-2013-2217?
CVE-2013-2217 affects Suds versions up to 0.4 and is relevant for certain versions of openSUSE and Red Hat Enterprise Linux.
What does CVE-2013-2217 exploit?
CVE-2013-2217 can be exploited through a symlink attack targeting a cache file created in the /tmp/suds/ directory.
Can CVE-2013-2217 be exploited remotely?
No, CVE-2013-2217 is a local vulnerability and requires access to the affected system to exploit.