CVE-2005-1632

Arbitrary code execution in Cheetah 0.9.15 and 0.9.16 via /tmp/ directory modules

• CVSS 7.2
• CWE-426: Untrusted Search Path
• Configuration Issues
• Local

Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.

CVE

CVE-2005-1632

CWE

CWE-426: Untrusted Search Path

CVSS base score

7.2

Published

2005-05-17

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Packaging Issues

Category

Configuration Issues

Subcategory

Dynamic Link Library (DLL) Loading Issues

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to Cheetah version 2.5.6 or higher

import sys
import os

def modified_import(module_name):
    tmp_path = '/tmp'
    if os.path.isdir(tmp_path):
        sys.path.insert(0, tmp_path)

    module = __import__(module_name)
    return module

if __name__ == "__main__":
    module_name = "example_module"
    modified_import(module_name)

import sys
import os

def modified_import(module_name):
    python_path = os.environ.get('PYTHONPATH', '').split(os.pathsep)

    filtered_paths = [path for path in python_path if os.path.isabs(path) and path != '/tmp']

    for path in filtered_paths:
        sys.path.insert(0, path)
        try:
            module = __import__(module_name)
            return module
        finally:
            sys.path.pop(0)

if __name__ == "__main__":
    module_name = "example_module"
    modified_import(module_name)

@misc{vaitp:cve20051632,
  title        = {{Arbitrary code execution in Cheetah 0.9.15 and 0.9.16 via /tmp/ directory modules}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2005},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2005-1632},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2005-1632/}}
}