CVE-2015-20107

Command injection in mailcap module

• CVSS 7.6
• CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
• Input Validation and Sanitization
• Remote

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9.

CVE

CVE-2015-20107

CWE

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVSS base score

7.6

Published

2022-04-13

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Missing Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Upgrade Python to version 3.10.9 or higher.

import mailcap

def findmatch(name, mime_type):
    command = mailcap.findmatch(name, mime_type)
    return command

if __name__ == "__main__":
    user_input = "example_command"
    mime_type = "text/plain"
    command = findmatch(user_input, mime_type)
    print("Command to execute:", command)

import mailcap
import shlex

def findmatch(name, mime_type):
    command = mailcap.findmatch(name, mime_type)
    if command:
        analyzed_command = shlex.quote(command)
        return analyzed_command
    return None

if __name__ == "__main__":
    user_input = "example_command"
    mime_type = "text/plain"
    command = findmatch(user_input, mime_type)
    print("Safe command to execute:", command)

@misc{vaitp:cve201520107,
  title        = {{Command injection in mailcap module}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-20107},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-20107/}}
}