PT-2023-6832 · Python+1 · Python+1

Carreau · Published 2023-02-10 · Updated 2024-08-07 · CVE-2023-24816

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IPython versions prior to 8.10.0

Description The issue exists due to the lack of neutralization of special elements used in the operating system command. Exploitation of this issue may allow an attacker to execute arbitrary commands by providing specially crafted data to the application. This vulnerability requires the IPython.utils.terminal.set term title function to be called on Windows in a Python environment where ctypes is not available. The vulnerability can be exploited if an attacker can control directory names and manage to get a user to change into this directory, then the attacker can execute arbitrary commands contained in the folder names.

Recommendations For versions prior to 8.10.0, users are advised to upgrade to version 8.10.0 or later. For users unable to upgrade, ensure that any calls to the IPython.utils.terminal.set term title function are done with trusted or filtered input. As a temporary workaround, consider restricting access to the set term title function until a patch is available.

Exploit

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

ALT-PU-2023-2107

BDU:2023-07707

CVE-2023-24816

GHSA-29GW-9793-FVW7

PYSEC-2023-17

Affected Products

Alt Linux

Python

References · 19

• 🔥 https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24816.json · Exploit
• https://github.com/ipython/ipython/commit/385d69325319a5972ee9b5983638e3617f21cb1f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-24816 · Security Note
• https://bdu.fstec.ru/vul/2023-07707 · Security Note
• https://osv.dev/vulnerability/GHSA-29gw-9793-fvw7 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-24816 · Security Note
• https://ubuntu.com/security/CVE-2023-24816 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-24816 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24816 · Vendor Advisory
• https://github.com/ipython/ipython/blob/56e6925dfa50e2c7f4a6471547b8176275db7c25/IPython/utils/_process_win32.py#L20 · Note
• https://github.com/ipython/ipython/blob/3f0bf05f072a91b2a3042d23ce250e5e906183fd/IPython/utils/terminal.py#L103-L117 · Note
• https://github.com/ipython/ipython/commit/991849c247fc208628879e7ca2923b3c218a5a75 · Note
• https://github.com/ipython/ipython · Note