pysec - pysec-2023-262

PYSEC-2023-262

Vulnerability from pysec - Published: 2023-12-12 18:15 - Updated: 2024-10-09 19:20

Details

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impacted products

Name	purl
searchor	pkg:pypi/searchor

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "searchor",
        "purl": "pkg:pypi/searchor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16016506f7bf92b0f21f51841d599126d6fcd15b"
            }
          ],
          "repo": "https://github.com/ArjunSharda/Searchor",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.1.0",
        "1.1.1",
        "1.2.0",
        "1.3.0",
        "1.4.0",
        "2.0.0",
        "2.0.1",
        "2.0.2",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.1.4",
        "2.1.5",
        "2.1.6",
        "2.2.0",
        "2.2.1",
        "2.2.2",
        "2.2.3",
        "2.3.0",
        "2.3.1",
        "2.3.2",
        "2.4.0",
        "2.4.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-43364",
    "GHSA-66m2-493m-crh2"
  ],
  "details": "main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.",
  "id": "PYSEC-2023-262",
  "modified": "2024-10-09T19:20:24.594458+00:00",
  "published": "2023-12-12T18:15:00+00:00",
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/ArjunSharda/Searchor/pull/130"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ArjunSharda/Searchor/pull/130"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-66m2-493m-crh2"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-66M2-493M-CRH2

Vulnerability from github – Published: 2023-09-25 18:37 – Updated: 2024-10-09 22:52

Summary

Searchor CLI's Search vulnerable to Arbitrary Code using Eval

Details

An issue in Arjun Sharda's Searchor before version v.2.4.2 allows an attacker to execute arbitrary code via a crafted script to the eval() function in Searchor's src/searchor/main.py file, affecting the search feature in Searchor's CLI (Command Line Interface).

Impact

Versions equal to, or below 2.4.1 are affected.

Patches

Versions above, or equal to 2.4.2 have patched the vulnerability.

References

https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit- https://github.com/jonnyzar/POC-Searchor-2.4.2 https://github.com/ArjunSharda/Searchor/pull/130

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.4.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "searchor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-43364"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-25T18:37:51Z",
    "nvd_published_at": "2023-12-12T18:15:22Z",
    "severity": "CRITICAL"
  },
  "details": " An issue in Arjun Sharda\u0027s Searchor before version v.2.4.2 allows an attacker to\n execute arbitrary code via a crafted script to the eval() function in Searchor\u0027s src/searchor/main.py file, affecting the search feature in Searchor\u0027s CLI (Command Line Interface).\n\n### Impact\nVersions equal to, or below 2.4.1 are affected.\n\n### Patches\nVersions above, or equal to 2.4.2 have patched the vulnerability.\n\n### References\nhttps://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection\nhttps://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-\nhttps://github.com/jonnyzar/POC-Searchor-2.4.2\nhttps://github.com/ArjunSharda/Searchor/pull/130",
  "id": "GHSA-66m2-493m-crh2",
  "modified": "2024-10-09T22:52:25Z",
  "published": "2023-09-25T18:37:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ArjunSharda/Searchor/security/advisories/GHSA-66m2-493m-crh2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43364"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ArjunSharda/Searchor/pull/130"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ArjunSharda/Searchor"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-66m2-493m-crh2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/searchor/PYSEC-2023-262.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Searchor CLI\u0027s Search vulnerable to Arbitrary Code using Eval"
}

CVE-2023-43364 (GCVE-0-2023-43364)

Vulnerability from cvelistv5 – Published: 2023-12-12 00:00 – Updated: 2024-10-09 13:30

Summary

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre

References

URL

Tags

	https://github.com/ArjunSharda/Searchor/pull/130
	https://github.com/nexis-nexis/Searchor-2.4.0-POC…
	https://github.com/nikn0laty/Exploit-for-Searchor…
	https://github.com/advisories/GHSA-66m2-493m-crh2
	https://github.com/ArjunSharda/Searchor/commit/16…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:37:23.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ArjunSharda/Searchor/pull/130"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-66m2-493m-crh2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-43364",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-09T13:28:56.222412Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-09T13:30:12.973Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-12T17:17:49.698679",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/ArjunSharda/Searchor/pull/130"
        },
        {
          "url": "https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-"
        },
        {
          "url": "https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection"
        },
        {
          "url": "https://github.com/advisories/GHSA-66m2-493m-crh2"
        },
        {
          "url": "https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-43364",
    "datePublished": "2023-12-12T00:00:00",
    "dateReserved": "2023-09-18T00:00:00",
    "dateUpdated": "2024-10-09T13:30:12.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2023-262

GHSA-66M2-493M-CRH2

Impact

Patches

References

CVE-2023-43364 (GCVE-0-2023-43364)

Tags

Sightings

Nomenclature