AVID-2026-R1255

Description

AWS data.all vulnerable to RCE through user injection of Python Commands (CVE-2023-36467)

Details

AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around.

Reason for inclusion in AVID: CVE-2023-36467 describes a remote code execution in aws-dataall (data.all), a data-pipeline framework often used in AI data preparation/governance. It is a software supply-chain issue in a component used to build/run AI data workflows, with explicit CVE details and a fix in v1.5.2+; therefore it constitutes a security vulnerability in the AI software supply chain.

References

Affected or Relevant Artifacts

Developer: awslabs
Deployer: awslabs
Artifact Details:

Type	Name
System	aws-dataall

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score	8.0
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-94	CWE-94: Improper Control of Generation of Code (‘Code Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-06-28
Version: 0.3.3
AVID Entry