CVE-2024-9287

Improper quoting in CPython `venv` allows command injection in activation scripts.

• CVSS 5.3
• CWE-77
• Input Validation and Sanitization
• Local

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

CVE

CVE-2024-9287

CWE

CWE-77

CVSS base score

5.3

Published

2024-10-22

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade to CPython version 3.10.10 or later, where this vulnerability is patched.

import os
import subprocess

def create_virtualenv(env_dir):
    """Vulnerable function that demonstrates the security issue."""
    if os.path.exists(env_dir):
        raise FileExistsError(f"Directory {env_dir} already exists.")
    
    subprocess.run(f"python3 -m venv {env_dir}", shell=True)

if __name__ == "__main__":
    env_directory = "myenv; rm -rf /"
    create_virtualenv(env_directory)
    
    activate_script = os.path.join(env_directory, 'bin', 'activate')
    subprocess.run(f"source {activate_script}", shell=True)

import os
import subprocess
import sys
import venv

def create_virtualenv(env_dir):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    if os.path.exists(env_dir):
        raise FileExistsError(f"Directory {env_dir} already exists.")
    
    builder = venv.EnvBuilder(with_pip=True)
    builder.create(env_dir)

if __name__ == "__main__":
    env_directory = "myenv; rm -rf /"
    create_virtualenv(env_directory)
    
    activate_script = os.path.join(env_directory, 'bin', 'activate')
    subprocess.run([sys.executable, '-m', 'venv', activate_script])

; echo "Malicious command executed" >> /tmp/malicious_output.txt

@misc{vaitp:cve20249287,
  title        = {{Improper quoting in CPython `venv` allows command injection in activation scripts.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-9287},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-9287/}}
}