CVE-2024-23346

Critical vulnerability in Pymatgen allows arbitrary code execution via eval().

• CVSS 7.8
• CWE-77
• Input Validation and Sanitization
• Remote

Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.

CVE

CVE-2024-23346

CWE

CWE-77

CVSS base score

7.8

Published

2024-02-21

OWASP

A01 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Pymatgen

Fixed by upgrading

Yes

Solution

Upgrade to Pymatgen version 2024.2.20 or later.

from pymatgen.transformations.standard_transformations import JonesFaithfulTransformation

# Example of insecure usage that could lead to code execution
transformation_str = "__import__('os').system('echo Vulnerable!')"
transformation = JonesFaithfulTransformation.from_transformation_str(transformation_str)

from pymatgen.transformations.standard_transformations import JonesFaithfulTransformation

# Example of secure usage without eval
transformation_str = "some_safe_transformation_string"
transformation = JonesFaithfulTransformation.from_transformation_str(transformation_str)

"__import__('os').system('ls')"

@misc{vaitp:cve202423346,
  title        = {{Critical vulnerability in Pymatgen allows arbitrary code execution via eval().}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-23346},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-23346/}}
}