Improper Control of Generation of Code ('Code Injection') Affecting paddlepaddle package, versions [,2.6.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PADDLEPADDLE-6183714
- published 22 Jan 2024
- disclosed 20 Jan 2024
- credit zer0h
Introduced: 20 Jan 2024
CVE-2024-0521 Open this link in a new tabHow to fix?
Upgrade paddlepaddle to version 2.6.0 or higher.
Overview
paddlepaddle is a Parallel Distributed Deep Learning
Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the _wget_download function, due to the url parameter being incorporated into the command string without proper validation or sanitization. An attacker can execute arbitrary code by injecting malicious input into the code generation routine.
PoC
from paddle import utils
utils.download._wget_download("aa; touch codexecution", "bb")
References
CVSS Scores
version 3.1