CVE-2022-24065: OS Command Injection in cookiecutter
Summary
CVE-2022-24065: OS Command Injection in cookiecutter. Affects cookiecutter versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Also tracked for
- cookiecutter · Debian:12
The same CVE-2022-24065 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package cookiecutter is a popular tool used for creating projects from project templates. It allows users to generate project structures by providing a template directory and answering a series of prompts. The cookiecutter function in Python code is used to invoke the tool. However, versions before 2.1.1 are vulnerable to OS Command Injection via the hg argument injection. This vulnerability arises when the checkout parameter is passed to the hg checkout command, allowing additional flags to be set. An attacker can exploit this to execute arbitrary commands.
Vulnerability Detail
The OS Command Injection vulnerability in cookiecutter allows an attacker to execute arbitrary commands by injecting additional flags into the hg checkout command. By manipulating the checkout parameter, an attacker can pass malicious commands to the underlying operating system. This can lead to unauthorized access, data leakage, or even complete compromise of the system. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.1.1
This is the first release that contains the fix.
pip install --upgrade "cookiecutter==2.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the checkout parameter when calling the cookiecutter function. By omitting this parameter, the vulnerability can be mitigated. However, this may limit certain functionalities of the tool. It is strongly advised to apply the recommended fix by upgrading to the latest version.
Conclusion
The OS Command Injection vulnerability in cookiecutter can have serious security implications. It is crucial to apply the recommended fix by upgrading to version 2.1.1 or later. This will ensure that the vulnerability is patched and the system is protected. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cookiecutter →
FAQ
Cookiecutter is a tool used for generating project structures from project templates. It simplifies the process of setting up new projects by providing a template directory and interactive prompts.
The vulnerability occurs when the checkout parameter is passed to the hg checkout command in a way that allows additional flags to be set. An attacker can manipulate this parameter to inject arbitrary commands.
The OS Command Injection vulnerability in cookiecutter can lead to unauthorized access, data leakage, or complete compromise of the system. Attackers can execute arbitrary commands with the privileges of the user running the cookiecutter function.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to version 2.1.1 or later of the cookiecutter package. Users can update their package by running the command 'pip install --upgrade cookiecutter'.
Related vulnerabilities
Recent vulnerabilities recorded for cookiecutter.
