CVE-2023-39660

Remote code execution via crafted prompt function request.

• CVSS 9.8
• CWE-94
• Input Validation and Sanitization
• Remote

An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.

CVE

CVE-2023-39660

CWE

CWE-94

CVSS base score

9.8

Published

2023-08-21

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

pandasai

Fixed by upgrading

Yes

Solution

Upgrade to Gaberiele Venturi pandasai v.0.8.1 or later.

def prompt():
    """Vulnerable function that demonstrates the security issue."""
    user_input = input("Enter your command: ")
    exec(user_input)

def main():
    """Vulnerable function that demonstrates the security issue."""
    prompt()

if __name__ == "__main__":
    main()

def prompt():
    """Secure function that fixes the vulnerability."""
    blacklist = ["import", "os", "sys", "eval", "exec", "open", "__", "subprocess", "input", "globals", "locals"]
    user_input = input("Enter your command: ")
    if any(word in user_input for word in blacklist):
        print("Unsafe command detected.")
        return
    try:
        exec(user_input)
    except Exception as e:
        print(f"Error executing command: {e}")

def main():
    """Secure function that fixes the vulnerability."""
    prompt()

if __name__ == "__main__":
    main()

__import__('os').system('whoami')

@misc{vaitp:cve202339660,
  title        = {{Remote code execution via crafted prompt function request.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-39660},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-39660/}}
}