Headline
GHSA-8mjr-6c96-39w8: pydash Command Injection vulnerability
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.
Note:
The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:
The source object (argument 1) is not a built-in object such as list/dict (otherwise, the init.globals path is not accessible)
The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)
The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.
pydash Command Injection vulnerability
High severity GitHub Reviewed Published Sep 28, 2023 to the GitHub Advisory Database • Updated Sep 28, 2023
Package
pip pydash (pip)
Affected versions
< 6.0.0
Patched versions
6.0.0
Description
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.
Note:
The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:
The source object (argument 1) is not a built-in object such as list/dict (otherwise, the init.globals path is not accessible)
The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)
The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-26145
- dgilland/pydash@6ff0831
- https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca
- https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518
- https://github.com/pypa/advisory-database/tree/main/vulns/pydash/PYSEC-2023-179.yaml
Published to the GitHub Advisory Database
Sep 28, 2023
Reviewed
Sep 28, 2023
Last updated
Sep 28, 2023
Severity
High
7.4
/ 10
CVSS base metrics
Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
No CWEs
CVE ID
CVE-2023-26145
GHSA ID
GHSA-8mjr-6c96-39w8
Source code
dgilland/pydash
Checking history
See something to contribute? Suggest improvements for this vulnerability.
Related news
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects. **Note:** The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied: 1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible) 2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method) The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.