Skip to main content

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2024-9287

Medium
5.3/10

Summary

A vulnerability has been found in the CPython "venv" module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (i.e, "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (i.e., "./venv/bin/python") are not affected. The issue affects CPython versions 2.7 prior to v3.9.21, 3.10.x prior to v3.10.16, v3.11.x prior to v3.11.11, v3.12.x prior to v3.12.8, v3.13.x prior to v3.13.1, and v3.14.0a1.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-77 - Command Injection

A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.

References

Advisory Timeline

  • Published