oss-sec mailing list archives
Potential symlink attack in python3 __pycache__
From: Georgi Guninski <gguninski () gmail com>
Date: Sat, 24 Jul 2021 18:33:44 +0300
Not sure if this is vulnerability, but it looks like classical symlink attack. In python3, if a script in directory DIR1 does "import another", then python3 creates directory __pycache__ in DIR1 and puts some files in __pycache__. According to our tests, if DIR1/__pycache__ is symlink to something, then python3 follows the symlink. We suspect the attacker has little to no control on the created files, except that the files are created. Here is an artificial session of root shooting herself in the leg on ubuntu 20: root@bialokote:~# python3 --version Python 3.8.10 root@bialokote:~# cat /tmp/a.py try: import joro2 except: print("error in import (2)") root@bialokote:~# cat /tmp/joro2.py print("in joro 2") blah=0 root@bialokote:~# rm ~/tests/* root@bialokote:~# rm /tmp/__pycache__ #XXX root@bialokote:~# ls -l ~/tests total 0 root@bialokote:~# ln -s ~/tests/ /tmp/__pycache__ #XXX shooting in leg root@bialokote:~# python3 /tmp/a.py in joro 2 root@bialokote:~# ls -l ~/tests total 4 -rw-r--r-- 1 root root 144 Jul 24 16:58 joro2.cpython-38.pyc root@bialokote:~#
Current thread:
- Potential symlink attack in python3 __pycache__ Georgi Guninski (Jul 24)
- Re: Potential symlink attack in python3 __pycache__ Michael Orlitzky (Jul 24)
- Re: Potential symlink attack in python3 __pycache__ Georgi Guninski (Jul 26)
- Re: Potential symlink attack in python3 __pycache__ Santiago Torres (Jul 26)
- Re: Potential symlink attack in python3 __pycache__ Jakub Wilk (Jul 26)
- Re: Potential symlink attack in python3 __pycache__ Georgi Guninski (Jul 26)
- Re: Potential symlink attack in python3 __pycache__ Michael Orlitzky (Jul 24)