CVE-2023-41334

Astropy 5.3.2 is vulnerable to remote code execution via improper input validation.

• CVSS 8.4
• CWE-77
• Input Validation and Sanitization
• Remote

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.

CVE

CVE-2023-41334

CWE

CWE-77

CVSS base score

8.4

Published

2024-03-18

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Astropy

Fixed by upgrading

Yes

Solution

Upgrade to Astropy version 5.3.3 or later.

import subprocess
from astropy.visualization import TransformGraph

def to_dot_graph(savelayout):
    """Vulnerable function that demonstrates the security issue."""
    # VULNERABLE: This code is susceptible to command injection
    graph = TransformGraph()
    dot_graph = graph.to_dot_graph()

    subprocess.Popen([savelayout])

to_dot_graph('command_or_script')

import subprocess
import os
import shlex
from astropy.visualization import TransformGraph

def to_dot_graph(savelayout):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    graph = TransformGraph()
    dot_graph = graph.to_dot_graph()

    if not isinstance(savelayout, str):
        raise ValueError("Invalid input: The save layout should be a string representing a valid file path.")
    
    if not os.path.isfile(savelayout):
        raise ValueError(f"The file path '{savelayout}' is invalid or does not exist.")
    
    command = shlex.split(savelayout)
    
    subprocess.Popen(command)

to_dot_graph('command_or_script')

"; rm -rf /"  # Example of a destructive payload

@misc{vaitp:cve202341334,
  title        = {{Astropy 5.3.2 is vulnerable to remote code execution via improper input validation.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-41334},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-41334/}}
}