CVE-2009-0318

Untrusted search path vulnerability in Gnumeric's Python interpreter allows local code execution with a malicious Python file in the current directory

• CVSS 6.9
• CWE-426: Untrusted Search Path
• Authentication, Authorization, and Session Management
• Local

Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).

CVE

CVE-2009-0318

CWE

CWE-426: Untrusted Search Path

CVSS base score

6.9

Published

2009-01-28

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Gnumeric to a version that addresses CVE-2008-5983.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

@misc{vaitp:cve20090318,
  title        = {{Untrusted search path vulnerability in Gnumeric's Python interpreter allows local code execution with a malicious Python file in the current directory}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2009},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2009-0318},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2009-0318/}}
}