CVE-2023-6597

Symlink dereferencing in tempfile.TemporaryDirectory allows permission changes.

• CVSS 7.8
• CWE-20
• Authorization, Authentication, and Session Management
• Local

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

CVE

CVE-2023-6597

CWE

CWE-20

CVSS base score

7.8

Published

2024-03-19

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Check

Category

Authorization, Authentication, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Privilege Escalation

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade to CPython version 3.12.2 or later.

import tempfile
import os
import stat

with tempfile.TemporaryDirectory() as temp_dir:
    target_file = os.path.join(temp_dir, 'target_file.txt')
    with open(target_file, 'w') as f:
        f.write('This is a target file.')

    symlink_path = os.path.join(temp_dir, 'symlink_to_target')
    os.symlink(target_file, symlink_path)

    os.chmod(target_file, stat.S_IRUSR)

    try:
        os.remove(symlink_path)
    except Exception as e:
        print(f'Error during cleanup: {e}')

import tempfile
import os
import stat

with tempfile.TemporaryDirectory() as temp_dir:
    target_file = os.path.join(temp_dir, 'target_file.txt')
    
    with open(target_file, 'w') as f:
        f.write('This is a target file.')

    symlink_path = os.path.join(temp_dir, 'symlink_to_target')
    
    try:
        if os.path.exists(symlink_path):
            os.remove(symlink_path)
        os.symlink(target_file, symlink_path)
    except OSError as e:
        print(f"Error creating symlink: {e}")
    
    os.chmod(target_file, stat.S_IRUSR)
    
    try:
        if os.path.islink(symlink_path):
            os.remove(symlink_path)
    except Exception as e:
        print(f'Error during cleanup: {e}')

import os
import tempfile
import stat

# Create a temporary directory
with tempfile.TemporaryDirectory() as temp_dir:
    # Create a target file and a symlink to it
    target_file = os.path.join(temp_dir, 'target_file.txt')
    with open(target_file, 'w') as f:
        f.write('Sensitive data.')

    symlink_path = os.path.join(temp_dir, 'symlink_to_target')
    os.symlink(target_file, symlink_path)

    # Change permissions of the target file to simulate a permissions-related error
    os.chmod(target_file, stat.S_IRUSR)  # Read-only for the owner

    # Attempt to exploit the vulnerability by attempting to remove the symlink
    # This could lead to unintended permission changes on the target file
    try:
        os.remove(symlink_path)  # This could dereference the symlink
        # Here, an attacker could potentially modify permissions of the target file
        os.chmod(target_file

@misc{vaitp:cve20236597,
  title        = {{Symlink dereferencing in tempfile.TemporaryDirectory allows permission changes.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-6597},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-6597/}}
}