PT-2023-19070 · Pypi · Spotipy

Shaderbug · Published 2023-01-23 · Updated 2023-02-06 · CVE-2023-23608

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Spotipy versions prior to 2.22.1

Description The issue arises when a malicious URI is passed to the library, allowing it to be tricked into performing an operation on a different API endpoint than intended. This is possible because the code used to parse URIs and URLs accepts user data too liberally, enabling an attacker to insert arbitrary characters into the path used for API requests. For example, an attacker can redirect a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists by including ".." in the URI. The impact depends heavily on how a client application handles a URI from a user and uses the responses it receives from the API.

Recommendations For versions prior to 2.22.1, update to version 2.22.1 to resolve the issue. As a temporary workaround, consider performing stricter parsing of URLs and URIs to minimize the risk of exploitation. Restrict access to sensitive API endpoints to prevent unauthorized operations. Avoid using user-provided URIs directly in API requests until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-23608

GHSA-Q764-G6FM-555V

Affected Products

Spotipy

References · 8

• 🔥 https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23608.json · Exploit
• https://osv.dev/vulnerability/GHSA-q764-g6fm-555v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23608 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23608 · Vendor Advisory
• https://github.com/spotipy-dev/spotipy · Note
• https://t.me/cibsecurity/57008 · Telegram Post
• https://t.me/cvenotify/43695 · Telegram Post