CVE-2019-20916

Directory Traversal in pip < 19.2 allows overwriting files via URL with "../" in Content-Disposition header

• CVSS 7.5
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

CVE

CVE-2019-20916

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.5

Published

2020-09-04

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update pip to version 19.2 or higher.

import os

def read_file(filename):
    """Read file - VULNERABLE to path traversal"""
    try:
        # VULNERABILITY: No path validation
        # Attacker can use ../../../etc/passwd
        with open(filename, 'r') as f:
            return f.read()
    except Exception as e:
        return f"Error: {e}"

# Example exploitation:
# read_file("../../../etc/passwd")

import os
from pathlib import Path

def read_file_secure(filename):
    """Securely read file with path validation"""
    try:
        # Input validation
        if not filename or '..' in filename:
            return "Error: Invalid filename"
        
        # Restrict to safe directory
        safe_dir = Path("/safe_files")
        file_path = (safe_dir / filename).resolve()
        
        # Ensure path is within safe directory
        if not str(file_path).startswith(str(safe_dir)):
            return "Error: Path traversal detected"
        
        with open(file_path, 'r') as f:
            return f.read()
    except Exception:
        return "Error: Access denied"

@misc{vaitp:cve201920916,
  title        = {{Directory Traversal in pip < 19.2 allows overwriting files via URL with "../" in Content-Disposition header}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-20916},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-20916/}}
}