CVE-2021-22557: Google SLO Generator RCE Vulnerability

CVE-2021-22557 Overview

CVE-2021-22557 is a code injection vulnerability affecting Google's SLO Generator tool. The vulnerability allows for loading of YAML files that, if crafted in a specific format, can enable arbitrary code execution within the context of the SLO Generator application. This flaw stems from unsafe YAML deserialization, which attackers can exploit by providing maliciously crafted YAML configuration files.

Critical Impact

Successful exploitation allows an attacker to execute arbitrary code within the SLO Generator's runtime context, potentially leading to complete system compromise, data exfiltration, or lateral movement within cloud infrastructure environments.

Affected Products

• Google SLO Generator (all versions prior to the security fix in PR #173)
• Google SLO Generator 2.0.0 (specifically referenced in exploit documentation)

Discovery Timeline

• 2021-10-04 - CVE-2021-22557 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-22557

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command - Command Injection). The flaw exists in how SLO Generator processes YAML configuration files without proper input validation or sandboxing.

YAML parsing libraries, particularly in Python environments, can be vulnerable to arbitrary code execution when using unsafe loading methods like yaml.load() without specifying a safe loader. The SLO Generator appears to have utilized unsafe YAML deserialization, allowing specially crafted YAML documents to instantiate arbitrary Python objects and execute code during the parsing phase.

The vulnerability requires local access and user interaction, meaning an attacker would need to convince a victim to load a malicious YAML configuration file. Despite these requirements, the potential impact is severe as successful exploitation grants complete control over confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability lies in the insecure handling of YAML file parsing within the SLO Generator codebase. Python's PyYAML library supports a feature that allows YAML documents to instantiate arbitrary Python objects using special YAML tags (e.g., !!python/object/apply:). When the application uses yaml.load() without specifying Loader=yaml.SafeLoader, it becomes vulnerable to code execution through maliciously crafted YAML payloads.

Attack Vector

The attack requires local access to the target system and user interaction to execute. An attacker must craft a malicious YAML configuration file containing Python object instantiation directives. When a user loads this file through the SLO Generator, the unsafe YAML parser deserializes the malicious objects, leading to arbitrary code execution.

The attack flow typically involves:

1. Crafting a YAML file with embedded Python object instantiation tags
2. Distributing the malicious file to the target (via phishing, supply chain compromise, or repository manipulation)
3. Waiting for the victim to load the configuration file
4. Achieving code execution in the context of the SLO Generator process

Technical details and proof-of-concept information are available at Packet Storm Security.

Detection Methods for CVE-2021-22557

Indicators of Compromise

• Unexpected or unfamiliar YAML configuration files in SLO Generator directories
• YAML files containing Python object instantiation tags such as !!python/object/apply:, !!python/object/new:, or !!python/module:
• Unusual process spawning from the SLO Generator process
• Unexpected network connections initiated by the SLO Generator application

Detection Strategies

• Monitor file system activity for creation or modification of YAML files in SLO Generator configuration directories
• Implement file integrity monitoring (FIM) on SLO Generator configuration files
• Deploy endpoint detection rules to identify YAML files containing dangerous Python serialization tags
• Review application logs for parsing errors or unexpected code execution patterns

Monitoring Recommendations

• Enable verbose logging for the SLO Generator application to capture configuration file loading events
• Implement behavioral monitoring on systems running SLO Generator to detect anomalous process activity
• Configure alerts for any child process spawning from the SLO Generator runtime environment
• Monitor for outbound network connections from the SLO Generator process that deviate from normal SLO reporting patterns

How to Mitigate CVE-2021-22557

Immediate Actions Required

• Upgrade Google SLO Generator to a version that includes the security fix from PR #173
• Audit all existing YAML configuration files for potentially malicious content before loading
• Restrict file system permissions to prevent unauthorized modification of SLO Generator configuration files
• Implement a review process for any new YAML configurations before deployment

Patch Information

Google has addressed this vulnerability through a code change available in pull request #173 on the SLO Generator GitHub repository. The fix likely implements safe YAML loading by switching to yaml.safe_load() or specifying Loader=yaml.SafeLoader, which prevents the instantiation of arbitrary Python objects during YAML parsing.

Users should update their SLO Generator installation to a version that includes this security fix. Review the GitHub pull request for specific version information and upgrade instructions.

Workarounds

• If immediate patching is not possible, implement strict access controls on systems running SLO Generator to prevent unauthorized users from supplying configuration files
• Validate all YAML configuration files manually before loading, specifically checking for Python object instantiation tags
• Consider running SLO Generator in a containerized or sandboxed environment to limit the impact of potential code execution
• Implement application whitelisting to prevent unauthorized code execution from the SLO Generator process context

# Configuration example - Check for unsafe YAML patterns before loading
grep -r "!!python" /path/to/slo-generator/configs/
# If any matches are found, inspect the files carefully before use