CVE-2023-41050

Inadequate AccessControl in Zope allows information disclosure via Python's format functions

• CVSS 7.7
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• Information Leakage
• Remote

AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE

CVE-2023-41050

CWE

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSS base score

7.7

Published

2023-09-06

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update to AccessControl versions 4.4, 5.8, or 6.2.

class VulnerableContext:
    def __init__(self):
        self.secret_data = "Sensitive information"

def format(format_string, mapping):
    return format_string.format_map(mapping)

context = VulnerableContext()
user_input = "{secret_data}"
result = format(user_input, vars(context))
print(result)

import string

class ModifiedFormatter(string.Formatter):
    def get_value(self, key, args, kwargs):
        if isinstance(key, str):
            return kwargs.get(key, None)
        return super().get_value(key, args, kwargs)

def format_map(format_string, mapping):
    formatter = ModifiedFormatter()
    return formatter.vformat(format_string, (), mapping)

try:
    user_input = "{user_attr}"
    context = {'user_attr': 'Sensitive data'}
    result = format_map(user_input, context)
    print(result)
except Exception as e:
    print(f"Error: {e}")

@misc{vaitp:cve202341050,
  title        = {{Inadequate AccessControl in Zope allows information disclosure via Python's format functions}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-41050},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-41050/}}
}