CVE-2011-4213

Name of the Vulnerable Software and Affected Versions Google App Engine Python SDK versions prior to 1.5.4

Description The issue is related to the sandbox environment in the Google App Engine Python SDK, which does not properly restrict the use of the os module. This allows local users to bypass access restrictions and execute arbitrary commands. The exploitation occurs via a file blob storage.os reference within the code parameter to the "/ ah/admin/interactive/execute" API endpoint.

Recommendations For versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the ah/admin/interactive/execute API endpoint to minimize the risk of exploitation.