In short
- CVE-2023-49797 is a HIGH (CVSS 7.8) vulnerability affecting pyinstaller, pyinstaller (pyinstaller).
- Chance of exploitation in the next 30 days (EPSS): 0.32%, higher than 25.6% of all vulnerabilities.
- Fix: update to 5.13.1 or later.
Description
Impact
A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to.
A user is affected if all the following are satisfied:
- The user runs an application containing either
matplotlib or win32com.
- The application is ran as administrator (or at least a user with higher privileges than the attacker).
- The user's temporary directory is not locked to that specific user (most likely due to
TMP/TEMP environment variables pointing to an unprotected, arbitrary, non default location).
- Either:
- The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between
shutil.rmtree()'s builtin symlink check and the deletion itself
- The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links
Patches
The vulnerability has been addressed in https://github.com/pyinstaller/pyinstaller/pull/7827 which corresponds to pyinstaller >= 5.13.1
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No workaround, although the attack complexity becomes much higher if the application is built with Python >= 3.8.0.
NVD description
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free