CVE-2020-8315

Insecure dependency load upon launch on Windows 7 in Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1

• CVSS 5.5
• CWE-427: Uncontrolled Search Path Element
• Configuration Issues
• Local

In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.

CVE

CVE-2020-8315

CWE

CWE-427: Uncontrolled Search Path Element

CVSS base score

5.5

Published

2020-01-28

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Building Issues

Category

Configuration Issues

Subcategory

Dynamic Link Library (DLL) Loading Issues

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Upgrade Python to a version after 3.8.1 or use Windows 8 or later.

import os
import ctypes

def load_dll():
    
    try:
        ctypes.WinDLL("api-ms-win-core-path-l1-1-0.dll")
        print("Successfully loaded the DLL.")
    except Exception as e:
        print("Failed to load the DLL:", e)

if __name__ == "__main__":
    load_dll()

import os
import ctypes

def load_dll():
    system32_path = os.path.join(os.environ["SystemRoot"], "System32", "api-ms-win-core-path-l1-1-0.dll")

    try:
        ctypes.windll.kernel32.LoadLibraryExW(system32_path, 0, 0x00000800)
        print("Successfully loaded the DLL from System32.")
    except Exception as e:
        print("Failed to load the DLL:", e)


if __name__ == "__main__":
    load_dll()

@misc{vaitp:cve20208315,
  title        = {{Insecure dependency load upon launch on Windows 7 in Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-8315},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-8315/}}
}