CVE-2023-23608

Spotipy URI manipulation vulnerability

• CVSS 4.3
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include "..", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.

CVE

CVE-2023-23608

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

4.3

Published

2023-01-26

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Spotipy to version 2.22.1 or higher.

class Spotipy:
    def __init__(self):
        self.base_url = "https://api.spotify.com/v1"

    def track(self, track_id):
        url = f"{self.base_url}/tracks/{track_id}"
        return self.make_request(url)

    def make_request(self, url):
        print(f"Making request to: {url}")

spotipy = Spotipy()
spotipy.check("track_id_here")

import re
from urllib.parse import urlparse

class Spotipy:
    def __init__(self):
        self.base_url = "https://api.spotify.com/v1"

    def check_track(self, track_id):
        if not self.check(track_id):
            raise ValueError("Invalid track ID")

        url = f"{self.base_url}/tracks/{track_id}"
        return self.make_request(url)

    def check(self, path):
        return not re.search(r'\.\.', path)

    def make_request(self, url):
        print(f"Making request to: {url}")

spotipy = Spotipy()
try:
    spotipy.check("track_id_here")
except ValueError as e:
    print(e)

@misc{vaitp:cve202323608,
  title        = {{Spotipy URI manipulation vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-23608},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-23608/}}
}