CVE-2022-33000: Code Execution Backdoor in ml-scanner
Summary
CVE-2022-33000: The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package. Affects ml-scanner versions >= 0.1.0, < 0.1.7. Fixed in 0.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ml-scanner package is an open-source Python package available on PyPI. It is designed to provide scanning capabilities for machine learning models. The package allows users to analyze and evaluate machine learning models, providing insights and metrics. However, versions 0.1.0 to 0.1.5 of ml-scanner contain a code execution backdoor via the request package.
Vulnerability Detail
The vulnerability in ml-scanner allows attackers to execute arbitrary code, leading to unauthorized access to sensitive user information and digital currency keys. This can result in the compromise of user data and the escalation of privileges. The vulnerability originates from the improper handling of requests in the ml-scanner package, allowing malicious actors to exploit the backdoor and execute arbitrary code.
How To Fix
Minimum fixed version
0.1.7
This is the first release that contains the fix.
pip install --upgrade "ml-scanner==0.1.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the ml-scanner package versions 0.1.0 to 0.1.5 are vulnerable to a code execution backdoor, allowing attackers to execute arbitrary code and potentially gain unauthorized access to sensitive information. Users are strongly advised to upgrade to version 0.1.7 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ml-scanner →
FAQ
This vulnerability allows attackers to execute arbitrary code, potentially leading to unauthorized access to sensitive user information and digital currency keys. It can also result in the escalation of privileges.
Versions 0.1.0 to 0.1.5 of ml-scanner are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the moment, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version (0.1.7 or later) as soon as possible.
You can find more information about this vulnerability, including its technical details and the fix, in the advisory database of the PyPA organization. The source can be accessed at: https://github.com/pypa/advisory-database/blob/main/vulns/ml-scanner/PYSEC-2022-215.yaml
