EIQ-2022-0001

EIQ-2022-0001

CVE-2021-23727

Celery ≤5.2.1 is vulnerable to stored command injection

6 January 2022

2 - MEDIUM

6.6

2.12.0

Celery 5.2.1 and earlier is vulnerable to stored command injection. An attacker can store a malicious command as task metadata in the Celery backend. When an exception is triggered, celery deserializes and reads that particular task’s metadata, consequently executing the malicious command.

To exploit this vulnerability, the attacker must have direct access to the Celery backend.

The Intelligence Center uses Redis as its Celery backend, and partially mitigates this vulnerability with the following defaults:

• Secured with a generated password stored at /etc/eclecticiq-redis/local.conf.

• Bound to 127.0.0.1 for single-machine installations, allowing only local access.

Full mitigation requires an upgrade to Celery 5.2.2 and later.

Mitigated on Hosted Intelligence Center instances; Redis instances cannot be accessed externally.

Affected versions of the Intelligence Center:

Upgrade to IC 2.12.0. See assessment for mitigation on 2.11.x and earlier.

2.11.x and earlier

N/A