GHSA-29gw-9793-fvw7
Vulnerability from github
IPython provides an interactive Python shell and Jupyter kernel to use Python interactively. Versions prior to 8.10.0 are vulnerable to command injection in the set_term_title function under specific conditions. This has been patched in version 8.10.0.
Impact
Users are only vulnerable when calling this function in Windows in a Python environment where ctypes is not available. The dependency on ctypes in IPython.utils._process_win32 prevents the vulnerable code from ever being reached (making it effectively dead code). However, as a library that could be used by another tool, set_term_title could introduce a vulnerability for dependencies. Currently set_term_title is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user to cd into this directory, then the attacker can execute arbitrary commands contained in the folder names.
{
"affected": [
{
"ecosystem_specific": {
"affected_functions": [
"IPython.utils.terminal.set_term_title"
]
},
"package": {
"ecosystem": "PyPI",
"name": "IPython"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-24816"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-78"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-10T19:55:53Z",
"nvd_published_at": "2023-02-10T20:15:00Z",
"severity": "MODERATE"
},
"details": "IPython provides an interactive Python shell and Jupyter kernel to use Python interactively. Versions prior to 8.10.0 are vulnerable to command injection in the `set_term_title` [function](https://github.com/ipython/ipython/blob/3f0bf05f072a91b2a3042d23ce250e5e906183fd/IPython/utils/terminal.py#L103-L117) under specific conditions. This has been patched in version 8.10.0.\n\n### Impact \nUsers are only vulnerable when calling this function in Windows in a Python environment where [ctypes](https://docs.python.org/3/library/ctypes.html) is not available. The dependency on ctypes in `IPython.utils._process_win32` prevents the vulnerable code from ever being reached (making it effectively dead code). However, as a library that could be used by another tool, `set_term_title` could introduce a vulnerability for dependencies. Currently `set_term_title` is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user to `cd` into this directory, then the attacker can execute arbitrary commands contained in the folder names.",
"id": "GHSA-29gw-9793-fvw7",
"modified": "2023-02-10T22:08:04Z",
"published": "2023-02-10T19:55:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24816"
},
{
"type": "WEB",
"url": "https://github.com/ipython/ipython/commit/385d69325319a5972ee9b5983638e3617f21cb1f"
},
{
"type": "WEB",
"url": "https://github.com/ipython/ipython/commit/991849c247fc208628879e7ca2923b3c218a5a75"
},
{
"type": "WEB",
"url": "https://github.com/Carreau/ipython/blob/7557ade0ed927475d5ab5b573d0ea4febfb22683/docs/source/whatsnew/version8.rst#ipython-810"
},
{
"type": "PACKAGE",
"url": "https://github.com/ipython/ipython"
},
{
"type": "WEB",
"url": "https://github.com/ipython/ipython/blob/3f0bf05f072a91b2a3042d23ce250e5e906183fd/IPython/utils/terminal.py#L103-L117"
},
{
"type": "WEB",
"url": "https://github.com/ipython/ipython/blob/56e6925dfa50e2c7f4a6471547b8176275db7c25/IPython/utils/_process_win32.py#L20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "IPython vulnerable to command injection via set_term_title"
}