GHSA-9w2p-rh8c-v9g5

Source

https://github.com/advisories/GHSA-9w2p-rh8c-v9g5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-9w2p-rh8c-v9g5/GHSA-9w2p-rh8c-v9g5.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-9w2p-rh8c-v9g5

Aliases

Published

2023-12-09T00:39:46Z

Modified

2024-11-22T20:43:40.132496Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Local Privilege Escalation in Windows

Details

Impact

A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to.

A user is affected if all the following are satisfied:

The user runs an application containing either matplotlib or win32com.
The application is ran as administrator (or at least a user with higher privileges than the attacker).
The user's temporary directory is not locked to that specific user (most likely due to TMP/TEMP environment variables pointing to an unprotected, arbitrary, non default location).
Either:
- The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between <code>shutil.rmtree()</code>'s builtin symlink check and the deletion itself
- The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links

Patches

The vulnerability has been addressed in https://github.com/pyinstaller/pyinstaller/pull/7827 which corresponds to pyinstaller >= 5.13.1

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

No workaround, although the attack complexity becomes much higher if the application is built with Python >= 3.8.0.

Database specific

{
    "severity": "HIGH",
    "nvd_published_at": "2023-12-09T01:15:07Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-379",
        "CWE-732"
    ],
    "github_reviewed_at": "2023-12-09T00:39:46Z"
}

References

Affected packages

PyPI / pyinstaller

Package

Name: pyinstaller; View open source insights on deps.dev
Purl: pkg:pypi/pyinstaller

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.13.1

Affected versions

1.*

1.5

1.5.1

2.*

2.0

2.1

3.*

3.0

3.1

3.1.1

3.2

3.2.1

3.3

3.3.1

3.4

3.5

3.6

4.*

4.0

4.1

4.2

4.3

4.4

4.5

4.5.1

4.6

4.7

4.8

4.9

4.10

5.*

5.0

5.0.1

5.1

5.2

5.3

5.4

5.4.1

5.5

5.6

5.6.1

5.6.2

5.7.0

5.8.0

5.9.0

5.10.0

5.10.1

5.11.0

5.12.0

5.13.0