Google App Engine SDK Cross Site Request Forgery Vulnerability And Command Execution Weaknesses

Bugtraq ID:	50075
Class:	Design Error
CVE:	CVE-2011-1364
Remote:	Yes
Local:	No
Published:	Oct 11 2011 12:00AM
Updated:	Oct 12 2011 01:20PM
Credit:	Adi Sharabani
Vulnerable:	Google Google App Engine 1.5.3 Google Google App Engine 1.5 Google Google App Engine 1.0
Not Vulnerable:	Google Google App Engine 1.5.4

Google App Engine SDK Cross Site Request Forgery Vulnerability And Command Execution Weaknesses

Google App Engine SDK is prone to a cross-site request-forgery vulnerability and multiple command-execution weakness.

Exploiting these issues may allow a remote attacker to perform certain administrative actions and execute arbitrary commands. Other attacks are also possible.

Google App Engine versions prior to 1.5.4 are vulnerable.

Google App Engine SDK Cross Site Request Forgery Vulnerability And Command Execution Weaknesses

To exploit the cross-site request-forgery issue, an attacker must entice an unsuspecting victim into following a malicious URI.

The researcher who reported these issues has created exploits and proofs of concept. Please see the references for more information.

Google App Engine SDK Cross Site Request Forgery Vulnerability And Command Execution Weaknesses

Solution:
Reportedly, the vendor has fixed the issues. Please see the references for more information.

Google App Engine SDK Cross Site Request Forgery Vulnerability And Command Execution Weaknesses

References:

• A Code Execution Vulnerability in Google App Engine SDK for Python: A Security A (Watchfire)
  
• Google App Engine SDK (Google)