CVE-2022-26488

In Python < 3.10.3 on Windows, local users can gain privileges due to insecure search path, affecting versions 3.7 to 3.10

• CVSS 7.0
• CWE-426 Untrusted Search Path
• Design Defects
• Local

In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2.

CVE

CVE-2022-26488

CWE

CWE-426 Untrusted Search Path

CVSS base score

7.0

Published

2022-03-10

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Building Issues

Category

Design Defects

Subcategory

Security Misconfigurations

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Upgrade to Python 3.10.3 or later (alternatively disable PATH entries when installing Python on Windows).

import os
import sys

def add_user_path():
    user_directory = r"C:\Users\Public\Directory"

    current_path = os.environ.get('PATH', '')
    
    new_path = current_path + os.pathsep + user_directory
    os.environ['PATH'] = new_path

if __name__ == "__main__":
    add_user_path()
    print("Insecure PATH modified:", os.environ['PATH'])

import os
import sys

def path():
    directories = [r"C:\Python\Scripts", r"C:\Python"]
    
    current_path = os.environ.get('PATH', '')
    
    filtered_path = []
    for directory in current_path.split(os.pathsep):
        if os.access(directory, os.W_OK):
            print(f"Warning: User-writable directory found - {directory}")
        else:
            filtered_path.append(directory)

    filtered_path.extend(directories)
    os.environ['PATH'] = os.pathsep.join(filtered_path)

if __name__ == "__main__":
    path()
    print("Secure PATH set.")

@misc{vaitp:cve202226488,
  title        = {{In Python < 3.10.3 on Windows, local users can gain privileges due to insecure search path, affecting versions 3.7 to 3.10}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-26488},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-26488/}}
}