CVE-2020-15523

Python Trojan Horse DLL Loading Vulnerability

• CVSS 7.8
• CWE-427: Uncontrolled Search Path Element
• Design Defects
• Local

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.

CVE

CVE-2020-15523

CWE

CWE-427: Uncontrolled Search Path Element

CVSS base score

7.8

Published

2020-07-04

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Design Defects

Subcategory

Security Misconfigurations

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Upgrade to Python 3.6.11, 3.7.8, 3.8.4, or 3.9.0b5 on Windows.

import os
import sys

def set_path():
    # VULNERABLE: This code is susceptible to path traversal

    path = r"C:\Some\Example\Path"
    os.environ['PATH'] = path + os.pathsep + os.environ['PATH']
    
    sys.path = [path] + sys.path

if __name__ == "__main__":
    set_path()
    print("Python path set:", sys.path)

import os
import sys

def set_path():
    # SECURE: This version prevents path traversal
    path = r"C:\Python39"
    os.environ['PATH'] = path + os.pathsep + os.environ['PATH']
    
    sys.path = [path] + sys.path

if __name__ == "__main__":
    set_path()
    print("Python path set:", sys.path)

@misc{vaitp:cve202015523,
  title        = {{Python Trojan Horse DLL Loading Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-15523},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-15523/}}
}