CVE-2024-34062

Arbitrary code execution via non-boolean CLI arguments in tqdm.

• CVSS 4.8
• CWE-74
• Input Validation and Sanitization
• Local

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `–delim`, `–buf-size`, `–manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE

CVE-2024-34062

CWE

CWE-74

CVSS base score

4.8

Published

2024-05-03

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

tqdm

Fixed by upgrading

Yes

Solution

Upgrade to version 4.66.3 or later.

import sys
from tqdm import tqdm as original_tqdm

def tqdm(iterable, **kwargs):
    """Vulnerable function that demonstrates the security issue."""
    for key, value in kwargs.items():
        if key in ['--delim', '--buf-size', '--manpath']:
            eval(value)
    return original_tqdm(iterable, **kwargs)

if __name__ == "__main__":
    for i in tqdm(range(10), desc="Processing", total=10, buf_size="os.system('echo Vulnerable!')"):
        pass

from tqdm import tqdm as original_tqdm

ALLOWED_KEYS = {'desc', 'total', 'ncols', 'mininterval', 'maxinterval'}

def tqdm(iterable, **kwargs):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    kwargs = {k: v for k, v in kwargs.items() if k in ALLOWED_KEYS}
    return original_tqdm(iterable, **kwargs)

if __name__ == "__main__":
    for i in tqdm(range(10), desc="Processing", total=10, buf_size="os.system('echo Vulnerable!')"):
        pass

"os.system('echo Vulnerable!')"

@misc{vaitp:cve202434062,
  title        = {{Arbitrary code execution via non-boolean CLI arguments in tqdm.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-34062},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-34062/}}
}