VAITP Dataset

← Back to the dataset

CVE-2025-27154

Spotipy's cache file had weak permissions, exposing Spotify auth tokens. Fixed in 2.25.1.

  • CVSS 8.4
  • CWE-276
  • Configuration Issues
  • Local

Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r–r–` (644) permissions by default, when it could be locked down to `rw——-` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.

CVSS base score
8.4
Published
2025-02-27
OWASP
A01 Broken Access Control
Orthogonal defect classification
Interface
Code defect classification
Incorrect Functionality
Category
Configuration Issues
Subcategory
Security Misconfigurations
Accessibility scope
Local
Impact
Information Disclosure
Affected component
Spotipy
Fixed by upgrading
Yes

Solution

Upgrade to Spotipy version 2.25.1 or higher.

Vulnerable code sample

import os
import spotipy
from spotipy.cache_handler import CacheHandler

class CustomCacheHandler(CacheHandler):
    
    def __init__(self, cache_path=None):
    # VULNERABLE: This code is susceptible to path traversal
        self.cache_path = cache_path or '.spotipy_cache'

    def get_cached_token(self):
        try:
            with open(self.cache_path, 'r') as f:
                token_info = eval(f.read())
                return token_info
        except FileNotFoundError:
            return None
        except:
            return None

    def save_token_to_cache(self, token_info):
        try:
            with open(self.cache_path, 'w') as f:
                f.write(str(token_info))
            os.chmod(self.cache_path, 0o644)
        except Exception as e:
            print(f"Error saving token to cache: {e}")

    def delete_cached_token(self):
        try:
            os.remove(self.cache_path)
        except FileNotFoundError:
            pass
        except Exception as e:
            print(f"Error deleting token cache: {e}")



if __name__ == '__main__':
    client_id = 'YOUR_CLIENT_ID'
    client_secret = 'YOUR_CLIENT_SECRET'
    redirect_uri = 'YOUR_REDIRECT_URI'

    scope = 'user-read-email user-library-read playlist-modify-public'

    cache_handler = CustomCacheHandler(cache_path='.my_Custom_cache')

    sp = spotipy.Spotify(auth_manager=spotipy.SpotifyOAuth(client_id=client_id,
                                                           client_secret=client_secret,
                                                           redirect_uri=redirect_uri,
                                                           scope=scope,
                                                           cache_handler=cache_handler))

    try:
        user_profile = sp.me()
        print(f"Logged in as {user_profile['display_name']}")
    except Exception as e:
        print(f"Authentication failed: {e}")

Patched code sample

import os
import json
import spotipy
from spotipy.cache_handler import CacheHandler

class CustomCacheHandler(CacheHandler):
    
    def __init__(self, cache_path=None):
    # SECURE: This version prevents path traversal
        self.cache_path = cache_path or '.spotipy_cache'

    def get_cached_token(self):
        try:
            with open(self.cache_path, 'r') as f:
                token_info = json.load(f)
                return token_info
        except (FileNotFoundError, json.JSONDecodeError):
            return None

    def save_token_to_cache(self, token_info):
        try:
            with open(self.cache_path, 'w') as f:
                json.dump(token_info, f)
            os.chmod(self.cache_path, 0o600)
        except Exception as e:
            print(f"Error saving token to cache: {e}")

    def delete_cached_token(self):
        try:
            os.remove(self.cache_path)
        except FileNotFoundError:
            pass
        except Exception as e:
            print(f"Error deleting token cache: {e}")

if __name__ == '__main__':
    client_id = 'YOUR_CLIENT_ID'
    client_secret = 'YOUR_CLIENT_SECRET'
    redirect_uri = 'YOUR_REDIRECT_URI'

    scope = 'user-read-email user-library-read playlist-modify-public'

    cache_handler = CustomCacheHandler(cache_path='.my_Custom_cache')

    sp = spotipy.Spotify(auth_manager=spotipy.SpotifyOAuth(client_id=client_id,
                                                           client_secret=client_secret,
                                                           redirect_uri=redirect_uri,
                                                           scope=scope,
                                                           cache_handler=cache_handler))

    try:
        user_profile = sp.me()
        print(f"Logged in as {user_profile['display_name']}")
    except Exception as e:
        print(f"Authentication failed: {e}")

Cite this entry

@misc{vaitp:cve202527154,
  title        = {{Spotipy's cache file had weak permissions, exposing Spotify auth tokens. Fixed in 2.25.1.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-27154},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-27154/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::