PT-2023-31355 · Win32Com+2 · Win32Com+3
Highbwoodsend
·
Publicado
2023-12-08
·
Atualizado
2024-12-03
·
CVE-2023-49797
CVSS v3.1
8.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PyInstaller versions prior to 5.13.1
Description
A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. This can occur if the user runs an application containing either
matplotlib or win32com, the application is run as administrator, and the user's temporary directory is not locked to that specific user. The attacker must either carefully time the replacement of a temporary file with a symlink between shutil.rmtree()'s builtin symlink check and the deletion itself, or the application was built with Python 3.7.x or earlier, which has no protection against Directory Junctions links.Recommendations
For PyInstaller versions prior to 5.13.1, upgrade to
pyinstaller >= 5.13.1 to address the vulnerability. As a temporary workaround, consider building the application with Python >= 3.8.0 to increase the attack complexity. Restrict access to the temporary directory by locking it to the specific user and avoid using TMP/TEMP environment variables that point to an unprotected location. Avoid using the shutil.rmtree() function with untrusted input until the issue is resolved.Exploit
Correção
Incorrect Permission
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Pyinstaller
Python
Matplotlib
Win32Com