Patchfirst
Patchfirst
CVE-2021-32849 Public exploit High · 8.8 EPSS 7.6%

Arbitrary command execution in Gerapy

Gerapy · gerapy

Official description · CVE.org

Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.

Breakdown
65.1 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 2 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 3 months after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+3 mo
  3. First seen exploitedVulnCheck KEV evidence+2 yrs

See the family tree

3 related vulnerabilities in the same code over 18 months. The latest fix listed for gerapy is 0.9.9.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2020-7698Command Injection29 Jul 2020
  2. relatedHigh

    Why these are linked:

    • Fixed one release later0.9.3 → 0.9.8 (gerapy)
    • Same code patched: views.py (machine-matched)Functions: job_list, job_log, project_configure, task_removecommit e844660commit 49bcb19
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2021-43857Gerapy may contain remote code execution27 Dec 2021
  3. Next fix in the same packageMedium

    Why these are linked:

    • Fixed one release later0.9.8 → 0.9.9 (gerapy)
    • Similar weakness in the same product (machine-matched)same product + CWE + description similarity
    This CVECVE-2021-32849Arbitrary command execution in Gerapy26 Jan 2022

Fixes in gerapyPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 0.9.3CVE-2020-769829 Jul 2020
  2. 0.9.8CVE-2021-4385727 Dec 2021
  3. 0.9.9CVE-2021-3284926 Jan 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: gerapy.

PyPIgerapyGHSA-756h-r2c9-qp5jPYSEC-2022-17

Upgrade to 0.9.9 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2021-43857).

pippip install "gerapy>=0.9.9"

The first fix for CVE-2021-32849.

Affected versions

If you runUpgrade to
All versions before 0.9.90.9.9

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

5 links, grouped by NVD tag

x_refsource_MISC 4

securitylab.github.com/advisories/GHSL-2021-076-gerapy/github.com/Gerapy/Gerapy/issues/197github.com/Gerapy/Gerapy/issues/217lgtm.com/projects/g/Gerapy/Gerapy?mode=tree&ruleFocus=1505994646253

x_refsource_CONFIRM 1

github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j
↑ ↓ chooseEnter openEsc close