PT-2023-19070 · Pypi · Spotipy
Shaderbug
·
Publicado
2023-01-23
·
Atualizado
2023-02-06
·
CVE-2023-23608
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Spotipy versions prior to 2.22.1
Description
The issue arises when a malicious URI is passed to the library, allowing it to be tricked into performing an operation on a different API endpoint than intended. This is possible because the code used to parse URIs and URLs accepts user data too liberally, enabling an attacker to insert arbitrary characters into the path used for API requests. For example, an attacker can redirect a track lookup via
spotifyApi.track() to an arbitrary API endpoint like playlists by including ".." in the URI. The impact depends heavily on how a client application handles a URI from a user and uses the responses it receives from the API.Recommendations
For versions prior to 2.22.1, update to version 2.22.1 to resolve the issue. As a temporary workaround, consider performing stricter parsing of URLs and URIs to minimize the risk of exploitation. Restrict access to sensitive API endpoints to prevent unauthorized operations. Avoid using user-provided URIs directly in API requests until the issue is resolved.
Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Spotipy