VAITP Dataset

← Back to the dataset

CVE-2024-12389

Path traversal in gpt_academic allows arbitrary file writes, leading to RCE.

  • CVSS 8.8
  • CWE-29
  • Input Validation and Sanitization
  • Remote

A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction directory. An attacker can exploit this vulnerability to perform arbitrary file writes, which can lead to remote code execution.

CVE
CVE-2024-12389
CWE
CWE-29
CVSS base score
8.8
Published
2025-03-20
OWASP
A01 Broken Access Control
Orthogonal defect classification
Interface
Code defect classification
Incorrect Functionality
Category
Input Validation and Sanitization
Subcategory
Path Traversal
Accessibility scope
Remote
Impact
Arbitrary Code Execution
Affected component
py7zr
Fixed by upgrading
Yes

Solution

Upgrade to py7zr version 0.20.5 or later.

Vulnerable code sample

import py7zr
import os

def extract_archive(archive_path, extract_path):
    """
    Extracts a 7z archive to the specified path.
    Vulnerable to path traversal if archive contains files with malicious paths.
    """
    with py7zr.SevenZipFile(archive_path, mode='r') as archive:
        archive.extractall(path=extract_path)

if __name__ == '__main__':
    archive_file = 'malicious.7z'  # Example: Could contain files like '../../../../../../tmp/evil.txt'
    extraction_directory = 'extracted'

    # Create the extraction directory if it doesn't exist
    if not os.path.exists(extraction_directory):
        os.makedirs(extraction_directory)

    print(f"Extracting {archive_file} to {extraction_directory}")
    extract_archive(archive_file, extraction_directory)
    print("Extraction complete.")

Patched code sample

import py7zr
import os
import stat

def secure_extract(archive_path, extract_path):
    """
    Extracts a 7z archive securely, preventing path traversal vulnerabilities.

    Args:
        archive_path: Path to the 7z archive.
        extract_path: Directory to extract the archive to.
    """

    try:
        with py7zr.SevenZipFile(archive_path, mode='r') as archive:
            for name, item in archive.getmembers().items():
                dest_path = os.path.abspath(os.path.join(extract_path, name))

                # Check if the extracted path is within the intended directory
                if not dest_path.startswith(os.path.abspath(extract_path) + os.sep):
                    raise Exception(f"Path traversal detected: {name}")

            archive.extractall(path=extract_path)


    except Exception as e:
        print(f"Extraction failed: {e}")

if __name__ == '__main__':
    # Example usage (assuming you have a 7z file named 'test.7z')
    archive_file = 'test.7z'
    extraction_directory = 'extracted'

    # Create the extraction directory if it doesn't exist
    if not os.path.exists(extraction_directory):
        os.makedirs(extraction_directory)

    secure_extract(archive_file, extraction_directory)
    print("Extraction complete (hopefully securely!)")

Payload

../../../tmp/evil.sh:#!/bin/bash
echo "whoami > /tmp/output"
chmod +x /tmp/evil.sh

../../../tmp/trigger:#!/usr/bin/env python3
import os
import subprocess

def run_command(command):
    try:
        subprocess.run(command, shell=True, check=True, capture_output=True, text=True)
    except subprocess.CalledProcessError as e:
        print(f"Command failed with error: {e}")
        print(f"Stdout: {e.stdout}")
        print(f"Stderr: {e.stderr}")

run_command("/tmp/evil.sh")

Cite this entry

@misc{vaitp:cve202412389,
  title        = {{Path traversal in gpt_academic allows arbitrary file writes, leading to RCE.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-12389},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-12389/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::