CVE-2021-32834 : Eclipse Keti is a service that was designed to protect RESTfuls API using Attrib

Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.

Published 2021-09-09 02:15:15

Updated 2022-04-25 18:16:53

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-32834

Eclipse » Keti » Version: N/A
cpe:2.3:a:eclipse:keti:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-32834

EPSS FAQ

0.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-32834

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	3.1	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
8.2	HIGH	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N	1.8	5.8	GitHub, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-32834

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: security-advisories@github.com (Secondary)
CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-32834

https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/

GHSL-2021-063: Arbitrary code execution in Eclipse Keti - CVE-2021-32834 | GitHub Security Lab
Exploit;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-32834

Products affected by CVE-2021-32834

Exploit prediction scoring system (EPSS) score for CVE-2021-32834

CVSS scores for CVE-2021-32834

CWE ids for CVE-2021-32834

References for CVE-2021-32834