CVE-2023-6507

Extragroups parameter in CPython 3.12.0 `subprocess` module on POSIX platforms

• CVSS 4.9
• CWE-269 Improper Privilege Management
• Design Defects
• Local

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).

CVE

CVE-2023-6507

CWE

CWE-269 Improper Privilege Management

CVSS base score

4.9

Published

2023-12-08

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Design Defects

Subcategory

Inadequate Error Handling

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update to CPython 3.12.1

import subprocess

def subprocess_call(command):
    """Vulnerable function that demonstrates the security issue."""
    # VULNERABLE: This code is susceptible to command injection
    subprocess.run(command, extra_groups=[])

subprocess_call(['ls', '-l'])

import os
import subprocess

def subprocess_call(command, extra_groups=None):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    if extra_groups is None or len(extra_groups) > 0:
        os.setgroups(0, [])
        subprocess.run(command, extra_groups=extra_groups)

subprocess_call(['ls', '-l'], extra_groups=[1001, 1002])

@misc{vaitp:cve20236507,
  title        = {{Extragroups parameter in CPython 3.12.0 `subprocess` module on POSIX platforms}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-6507},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-6507/}}
}