CVE-2023-35932

jcvi Python library configuration injection

• CVSS 8.8
• CWE-1284
• Input Validation and Sanitization
• Remote

jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is for instance shell code execution from the configuration file values. This vulnerability does not currently have a fix.

CVE

CVE-2023-35932

CWE

CWE-1284

CVSS base score

8.8

Published

2023-06-23

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Solution

No fix available.

def create_config(user_input):
    """Vulnerable function that demonstrates the security issue."""
    config_content = f"[settings]\nuser_setting={user_input}"
    with open("config.ini", "w") as config_file:
        config_file.write(config_content)

def run_with_config():
    """Vulnerable function that demonstrates the security issue."""
    import configparser
    config = configparser.ConfigParser()
    config.read("config.ini")
    user_setting = config['settings']['user_setting']
    
    import os
    os.system(f"echo {user_setting}")

user_input = "dummy; cat /etc/passwd #"

create_config(user_input)
run_with_config()

import subprocess
import configparser
import re

def create_config(user_input):
    """Secure function that fixes the vulnerability."""
    sanitized_input = re.sub('[^A-Za-z0-9]+', '', user_input)
    config_content = f"[settings]\nuser_setting={sanitized_input}"
    with open("config.ini", "w") as config_file:
        config_file.write(config_content)

def run_with_config():
    """Secure function that fixes the vulnerability."""
    config = configparser.ConfigParser()
    config.read("config.ini")
    user_setting = config['settings']['user_setting']
    
    subprocess.run(["echo", user_setting], shell=False)

user_input = "dummy; cat /etc/passwd #"

create_config(user_input)
run_with_config()

@misc{vaitp:cve202335932,
  title        = {{jcvi Python library configuration injection}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-35932},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-35932/}}
}