PT-2023-12419 · Unknown · Nyuccl Psiturk

Blaiserideout · Published 2023-01-28 · Updated 2024-05-17 · CVE-2021-4315

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NYUCCL psiTurk versions up to 3.2.0

Description A critical issue has been found in NYUCCL psiTurk, affecting unknown code of the file psiturk/experiment.py. The manipulation of the mode argument leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue.

Recommendations For NYUCCL psiTurk versions up to 3.2.0, upgrade to version 3.2.1 to address the issue. As a temporary workaround, consider restricting the manipulation of the mode argument in the affected file psiturk/experiment.py until the upgrade is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

CVE-2021-4315

GHSA-9MQ4-9556-6QXQ

PYSEC-2023-43

Affected Products

Nyuccl Psiturk

References · 14

• 🔥 https://github.com/NYUCCL/psiTurk/pull/517 · Exploit
• https://github.com/NYUCCL/psiTurk/releases/tag/v3.2.1 · Patch
• https://github.com/NYUCCL/psiTurk/commit/47787e15cecd66f2aa87687bf852ae0194a4335f · Patch
• https://osv.dev/vulnerability/GHSA-9mq4-9556-6qxq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4315 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-43 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4315 · Vendor Advisory
• https://github.com/NYUCCL/psiTurk · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/psiturk/PYSEC-2023-43.yaml · Note
• https://t.me/cvenotify/43810 · Telegram Post
• https://vuldb.com/?id.219676 · Note
• https://t.me/cvenotify/43020 · Telegram Post
• https://t.me/cibsecurity/57132 · Telegram Post
• https://vuldb.com/?ctiid.219676 · Note