Critical Vulnerability in Python 2: Local File Scheme Bypass
Summary
ALPINE-CVE-2019-9948: urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('l... Affects python2 versions < 2.7.16-r1. Fixed in 2.7.16-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 2 is a widely-used programming language known for its simplicity and readability. The 'urllib' module in Python 2.x, specifically through version 2.7.16, facilitates URL handling and web requests. However, it contains a significant vulnerability that allows remote attackers to exploit the local_file: scheme, potentially bypassing security mechanisms designed to restrict access to local files.
Vulnerability Detail
The vulnerability arises from the 'urllib' module in Python 2.x through version 2.7.16, which supports the local_file: scheme. This support enables attackers to bypass protections that blacklist file: URIs. For instance, an attacker could execute a command like 'urllib.urlopen('local_file:///etc/passwd')', allowing unauthorized access to sensitive files on the server. This vulnerability poses a high risk as it can lead to data exposure and compromise the integrity of the system.
How To Fix
Minimum fixed version
2.7.16-r1
This is the first release that contains the fix.
sudo apk add --upgrade python2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to restrict the use of the local_file: scheme in your application. Additionally, ensure that your application does not allow user input to directly influence URL requests made through urllib.
Conclusion
The vulnerability in Python 2's urllib module poses a significant risk by allowing remote attackers to bypass security measures and access local files. It is crucial to update to the patched versions to protect against potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python2 →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
All versions of Python 2.x up to and including 2.7.16 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, data exposure, and potential system compromise.
Implementing strict input validation and avoiding the use of the local_file: scheme in your application can help mitigate the risk until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for python2.
