Summary
dataclasses-avroschema can generate Python code containing an unsafe fixed-type namespace value without escaping or validation. If an attacker can influence the namespace in an Avro schema processed for code generation, crafted input may alter the generated annotation and execute arbitrary Python code when the generated class is defined.
dataclasses-avroschema can generate Python code containing an unsafe fixed-type namespace value without escaping or validation. If an attacker can influence the namespace in an Avro schema processed for code generation, crafted input may alter the generated annotation and execute arbitrary Python code when the generated class is defined.
Affected context
The vulnerability occurs in dataclasses-avroschema deployments that generate Python code from Avro schemas and process fixed types whose namespace values are influenced by untrusted or insufficiently trusted input. It is specifically relevant when generated annotations are later evaluated as Python code during class definition.
The vulnerability occurs in dataclasses-avroschema deployments that generate Python code from Avro schemas and process fixed types whose namespace values are influenced by untrusted or insufficiently trusted input. It is specifically relevant when generated annotations are later evaluated as Python code during class definition.
Exploit preconditions
- Attack surface: Avro schema parsing and Python code generation
- Required access: Ability to supply or modify an Avro schema, or influence a fixed type's namespace value
- Trigger point: Generation and subsequent definition of the Python class containing the affected annotation
- Why exploitation is possible: The namespace is inserted into generated Python source without escaping or validation, allowing crafted input to change the surrounding expression
- Attack surface: Avro schema parsing and Python code generation
- Required access: Ability to supply or modify an Avro schema, or influence a fixed type's namespace value
- Trigger point: Generation and subsequent definition of the Python class containing the affected annotation
- Why exploitation is possible: The namespace is inserted into generated Python source without escaping or validation, allowing crafted input to change the surrounding expression
Why this happens
The underlying bug is an unsafe code-generation pattern. BaseGenerator.parse_fixed places a namespace value directly between quotes in a generated types.confixed annotation without ensuring that the value is a valid Avro name or safely escaped.
A quote in the namespace can terminate the intended string literal and inject additional Python expression content. Because the generated annotation is evaluated when the class is defined, attacker-controlled schema data can become executable code. This behavior maps to CWE-94: Improper Control of Generation of Code ('Code Injection').
The underlying bug is an unsafe code-generation pattern. BaseGenerator.parse_fixed places a namespace value directly between quotes in a generated types.confixed annotation without ensuring that the value is a valid Avro name or safely escaped.
A quote in the namespace can terminate the intended string literal and inject additional Python expression content. Because the generated annotation is evaluated when the class is defined, attacker-controlled schema data can become executable code. This behavior maps to CWE-94: Improper Control of Generation of Code ('Code Injection').
Potential impact
- Arbitrary Python code execution in the process generating or loading the class
- Compromise of application data and runtime secrets
- Modification of generated source or downstream build artifacts
- Lateral movement or broader system compromise, depending on process privileges
- Supply-chain or build-pipeline tampering
- Arbitrary Python code execution in the process generating or loading the class
- Compromise of application data and runtime secrets
- Modification of generated source or downstream build artifacts
- Lateral movement or broader system compromise, depending on process privileges
- Supply-chain or build-pipeline tampering
General mitigation guidance
Mitigation generally focuses on preventing schema data from becoming executable source code and reducing trust in externally supplied schemas.
Common defensive patterns include:
- Validate namespace values against a strict allowlist of dot-separated Avro names before code generation
- Escape generated string literals using a trusted source-code generation mechanism
- Prefer structured intermediate representations over direct string concatenation
- Avoid evaluating generated annotations or code when a non-executable representation is sufficient
- Treat schemas from external sources as untrusted and authenticate or review them before processing
- Run generation and class-loading workflows with least-privilege permissions and isolated credentials
Mitigation generally focuses on preventing schema data from becoming executable source code and reducing trust in externally supplied schemas.
Common defensive patterns include:
- Validate namespace values against a strict allowlist of dot-separated Avro names before code generation
- Escape generated string literals using a trusted source-code generation mechanism
- Prefer structured intermediate representations over direct string concatenation
- Avoid evaluating generated annotations or code when a non-executable representation is sufficient
- Treat schemas from external sources as untrusted and authenticate or review them before processing
- Run generation and class-loading workflows with least-privilege permissions and isolated credentials
How teams detect issues like this
Detection can include static analysis for direct interpolation of schema fields into Python source, especially values placed inside quoted literals or annotations. Code review should examine generator functions for missing escaping, schema validation, and evaluation of generated annotations.
Organizations can also enforce policies requiring strict Avro-name validation, prohibit dynamic evaluation in generation pipelines, and scan generated artifacts for unexpected imports, expressions, or executable constructs. Automated code review and security analysis tools may help identify these patterns during development.
Detection can include static analysis for direct interpolation of schema fields into Python source, especially values placed inside quoted literals or annotations. Code review should examine generator functions for missing escaping, schema validation, and evaluation of generated annotations.
Organizations can also enforce policies requiring strict Avro-name validation, prohibit dynamic evaluation in generation pipelines, and scan generated artifacts for unexpected imports, expressions, or executable constructs. Automated code review and security analysis tools may help identify these patterns during development.
