CVE-2022-45305

Insecure permissions in Chocolatey Python3 package (v3.11.0 and below)

• CVSS 4.3
• CWE-732: Incorrect Permission Assignment for Critical Resource
• Design Defects
• Local

Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder.

CVE

CVE-2022-45305

CWE

CWE-732: Incorrect Permission Assignment for Critical Resource

CVSS base score

4.3

Published

2022-11-29

OWASP

A01 Broken Access Control

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Packaging Issues

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Local

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Chocolatey Python3 package to v3.11.1 or higher

import os
import stat

def permissions(python_directory):
    # VULNERABLE: This code is susceptible to path traversal
    for root, dirs, files in os.walk(python_directory):
        for dir_name in dirs:
            dir_path = os.path.join(root, dir_name)
            os.chmod(dir_path, stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR |
                      stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP |
                      stat.S_IROTH | stat.S_IWOTH | stat.S_IXOTH)

        for file_name in files:
            file_path = os.path.join(root, file_name)
            os.chmod(file_path, stat.S_IRUSR | stat.S_IWUSR |
                      stat.S_IRGRP | stat.S_IWGRP |
                      stat.S_IROTH | stat.S_IWOTH)

permissions(r'C:\Python311')

import os
import stat

def permissions(python_directory):
    # SECURE: This version prevents path traversal
    for root, dirs, files in os.walk(python_directory):
        for dir_name in dirs:
            dir_path = os.path.join(root, dir_name)
            os.chmod(dir_path, stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR | stat.S_IRGRP | stat.S_IXGRP | stat.S_IROTH | stat.S_IXOTH)

        for file_name in files:
            file_path = os.path.join(root, file_name)
            os.chmod(file_path, stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH)

permissions(r'C:\Python311')

@misc{vaitp:cve202245305,
  title        = {{Insecure permissions in Chocolatey Python3 package (v3.11.0 and below)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-45305},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-45305/}}
}