CVE-2023-32309

Arbitrary File Read via Directory Traversal in PyMdown Extensions

• CVSS 7.5
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `–8<–"/etc/passwd"` or `–8<–"/proc/self/environ"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `–8<– "../../../../etc/passwd"`. Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed. This issue has been addressed in version 10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering input.

CVE

CVE-2023-32309

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.5

Published

2023-05-15

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update PyMdown Extensions to version 10.0 or higher.

import os

class Snippets:
    def __init__(self, base_path):
        self.base_path = os.path.abspath(base_path)

    def get_snippet_path(self, path):
        full_path = os.path.join(self.base_path, path)
        
        return full_path

import os

class Snippets:
    def __init__(self, base_path):
        self.base_path = os.path.abspath(base_path)

    def get_snippet_path(self, path):
        normalized_path = os.path.normpath(path)
        
        if not normalized_path.startswith(self.base_path):
            raise ValueError("Access to the specified path is not allowed.")
        
        full_path = os.path.join(self.base_path, normalized_path)
        
        if not os.path.isfile(full_path):
            raise FileNotFoundError("The specified file does not exist.")
        
        return full_path

@misc{vaitp:cve202332309,
  title        = {{Arbitrary File Read via Directory Traversal in PyMdown Extensions}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-32309},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-32309/}}
}