PT-2022-23158 · Poetry · Poetry

Neersighted + 1 · Published 2022-09-07 · Updated 2022-10-11 · CVE-2022-36070

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Poetry versions prior to 1.1.9 Poetry versions prior to 1.2.0b1

Description The issue arises from Poetry executing commands like git config using the executable's name instead of its absolute path. This can lead to the execution of untrusted code due to how Windows resolves executable names to paths, searching the current directory first and then the paths defined in the PATH environment variable. This can result in Arbitrary Code Execution, potentially leading to system takeover. If a developer is exploited, attackers could steal credentials or persist their access. On a server, attackers could use their access to attack other internal systems. The vulnerability requires user interaction and is particularly risky when dealing with untrusted files, as the behavior is undocumented and cannot be protected against by vetting Git or Poetry config files.

Recommendations Upgrade to version 1.1.9 or later to resolve the issue. Upgrade to version 1.2.0b1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Poetry with untrusted Git repositories until a patch is applied. Restrict access to directories that may contain malicious files to minimize the risk of exploitation.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2022-36070

GHSA-J4J9-7HG9-97G6

PYSEC-2022-43179

Affected Products

Poetry

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36070.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-36070 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36070 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j4j9-7hg9-97g6 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43179 · Vendor Advisory
• https://github.com/python-poetry/poetry · Note
• https://github.com/python-poetry/poetry/releases/tag/1.1.9 · Note
• https://github.com/python-poetry/poetry/releases/tag/1.2.0b1 · Note
• https://github.com/python-poetry/poetry/security/advisories/GHSA-j4j9-7hg9-97g6 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/poetry/PYSEC-2022-43179.yaml · Note