Malware in ctx: Compromised PyPI Package
Summary
GHSA-4g82-3jcr-q52w: Malware in ctx. Affects ctx versions < 0.1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ctx package is a Python library available on PyPI that provides a context manager for managing environment variables. It allows users to easily set and unset environment variables within a specific context. The package is widely used in Python projects for managing environment configurations.
Vulnerability Detail
The ctx package hosted on PyPI was compromised due to a user account compromise. The attacker replaced the legitimate package with a malicious version that contained runtime code. This code collected the content of the os.environ.items() function, which retrieves all environment variables, when instantiating Ctx objects. The captured environment variables were then sent as a base64 encoded query parameter to a Heroku application running at https://anti-theft-web.herokuapp.com. If the compromised package was installed between May 14, 2022, and May 24, 2022, and if sensitive data like passwords and API keys were present in the environment variables, it is advised to rotate those credentials and perform an audit to check for any potential exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. The recommended solution is to follow the steps mentioned in the 'how_to_fix' section to mitigate the issue.
Conclusion
The ctx package hosted on PyPI was compromised due to a user account compromise, leading to the distribution of a malicious version of the package. If you installed the package between May 14, 2022, and May 24, 2022, and if your environment variables contained sensitive data, it is advised to rotate those credentials and perform an audit. Follow the steps mentioned in the 'how_to_fix' section to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ctx →
FAQ
You can check if your project is affected by this vulnerability by examining the installed version of the ctx package. If the version falls within the affected range (0.0.1 to 0.1.4) and you installed the package between May 14, 2022, and May 24, 2022, there is a possibility that your project is affected.
If your project is affected, it is recommended to remove the compromised version of the ctx package and update to a secure version released after 0.1.4. Additionally, if sensitive data like passwords or API keys were present in the environment variables, it is advised to rotate those credentials and perform an audit.
To update the ctx package to a secure version, you can use the package manager for your Python project. For example, if you are using pip, you can run the command pip install --upgrade ctx to update to the latest secure version.
Unfortunately, it is not possible to determine if your environment variables were exploited solely based on the information provided in this advisory. It is recommended to rotate any sensitive credentials and perform an audit to check for any potential exploitation.
You can find more information about this vulnerability in the GitHub Advisory Database. The link to the specific advisory for this vulnerability is provided in the 'affected' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for ctx.
