CVE-2022-34060

PyPI "Togglee" v0.0.8: Critical code execution backdoor

• CVSS 9.8
• CWE-284: Improper Access Control
• Authentication, Authorization, and Session Management
• Remote

The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

CVE

CVE-2022-34060

CWE

CWE-284: Improper Access Control

CVSS base score

9.8

Published

2022-06-24

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Togglee package to version v0.0.9 or higher.

class Togglee:
    def __init__(self):
        self.settings = {}

    def set_setting(self, key, value):
        self.settings[key] = value

    def execute_code(self, code):
        exec(code)

togglee = Togglee()
togglee.set_setting('setting1', 'value1')
togglee.execute_code('import os; os.system("echo Vulnerable!")')

class Togglee:
    def __init__(self):
        self.settings = {}

    def set_setting(self, key, value):
        self.settings[key] = value

    def execute_command(self, command):
        allowed_commands = {
            "print_settings": self.print_settings,
        }

        action = allowed_commands.get(command)
        if action:
            action()
        else:
            raise ValueError("Invalid command")

    def print_settings(self):
        for key, value in self.settings.items():
            print(f"{key} = {value}")

togglee = Togglee()
togglee.set_setting('setting1', 'value1')
togglee.execute_command('print_settings')

@misc{vaitp:cve202234060,
  title        = {{PyPI "Togglee" v0.0.8: Critical code execution backdoor}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-34060},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-34060/}}
}