CVE-2022-34981: PyCrowdTangle Package Code Execution Backdoor
Summary
CVE-2022-34981: The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party. Affects pycrowdtangle versions >= 0.0.1, < 0.0.3. Fixed in 0.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PyCrowdTangle package is a Python library available on PyPI that provides functionality for accessing the CrowdTangle API. CrowdTangle is a social media analytics tool that allows users to monitor and analyze content on various social media platforms. The PyCrowdTangle package acts as a wrapper for the CrowdTangle API, enabling developers to easily interact with the service and retrieve data for analysis. Unfortunately, the package was found to contain a code execution backdoor inserted by a third party.
Vulnerability Detail
The vulnerability in the PyCrowdTangle package allows an attacker to execute arbitrary code on a system where the package is installed. The backdoor was inserted by a malicious actor and was present in versions prior to v0.0.1. This means that any system using PyCrowdTangle before v0.0.1 is potentially vulnerable to code execution attacks. The backdoor could be exploited by an attacker to gain unauthorized access, escalate privileges, or perform other malicious activities on the affected system.
How To Fix
Minimum fixed version
0.0.3
This is the first release that contains the fix.
pip install --upgrade "pycrowdtangle==0.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The PyCrowdTangle package before v0.0.1 included a code execution backdoor inserted by a third party. This vulnerability could allow an attacker to execute arbitrary code on an affected system. To mitigate the risk, users are advised to upgrade to PyCrowdTangle version 0.0.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pycrowdtangle →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The Vulert Playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
The code execution backdoor in the PyCrowdTangle package can allow an attacker to execute arbitrary code on an affected system. This could lead to unauthorized access, data breaches, privilege escalation, and other malicious activities.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly update to the latest version of PyCrowdTangle to mitigate the risk of potential attacks.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to the latest version of PyCrowdTangle to address the issue.
The maintainers of the PyCrowdTangle package are responsible for fixing this vulnerability. They have released version 0.0.3, which removes the code execution backdoor.
