CVE-2022-23530

GuardDog v0.1.8: Arbitrary file overwrite in PyPI packages

• CVSS 6.5
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.

CVE

CVE-2022-23530

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

6.5

Published

2022-12-16

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update GuardDog to version 0.1.8 or higher.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

@misc{vaitp:cve202223530,
  title        = {{GuardDog v0.1.8: Arbitrary file overwrite in PyPI packages}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-23530},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-23530/}}
}