GHSA-9w2p-rh8c-v9g5

Suggest an improvement
Source
https://github.com/advisories/GHSA-9w2p-rh8c-v9g5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-9w2p-rh8c-v9g5/GHSA-9w2p-rh8c-v9g5.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-9w2p-rh8c-v9g5
Aliases
Published
2023-12-09T00:39:46Z
Modified
2024-11-22T20:43:40.132496Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Local Privilege Escalation in Windows
Details

Impact

A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to.

A user is affected if all the following are satisfied:

  • The user runs an application containing either matplotlib or win32com.
  • The application is ran as administrator (or at least a user with higher privileges than the attacker).
  • The user's temporary directory is not locked to that specific user (most likely due to TMP/TEMP environment variables pointing to an unprotected, arbitrary, non default location).
  • Either:
    • The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between shutil.rmtree()'s builtin symlink check and the deletion itself
    • The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links

Patches

The vulnerability has been addressed in https://github.com/pyinstaller/pyinstaller/pull/7827 which corresponds to pyinstaller >= 5.13.1

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

No workaround, although the attack complexity becomes much higher if the application is built with Python >= 3.8.0.

Database specific 
{
    "nvd_published_at": "2023-12-09T01:15:07Z",
    "cwe_ids": [
        "CWE-379",
        "CWE-732"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-09T00:39:46Z"
}
References

Affected packages

PyPI / pyinstaller

Package

Name
pyinstaller
View open source insights on deps.dev
Purl
pkg:pypi/pyinstaller

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.13.1

Affected versions

1.*

1.5
1.5.1

2.*

2.0
2.1

3.*

3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
3.5
3.6

4.*

4.0
4.1
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
4.10

5.*

5.0
5.0.1
5.1
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0