CVE-2019-19010: Eval Injection in Limnoria Math Plugin
Summary
CVE-2019-19010: Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and i... Affects limnoria across 2 version ranges.
< 2019.11.09
< 3848ae78de45b35c029cc333963d436b9d2f0a35
Fixed in 3848ae78de45b35c029cc333963d436b9d2f0a35. How to fix ↓
Also tracked for
- limnoria · Debian:11
The same CVE-2019-19010 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Limnoria is an open-source Python-based IRC bot framework that provides a wide range of features and plugins. One of its plugins is the Math plugin, which allows users to perform mathematical calculations using IRC commands. However, versions of Limnoria prior to 2019.11.09 and Supybot through 2018-05-09 are vulnerable to eval injection attacks through the 'calc' and 'icalc' IRC commands. This vulnerability can be exploited by remote unprivileged attackers to disclose information or potentially cause other unspecified impacts.
Vulnerability Detail
The vulnerability in the Math plugin of Limnoria and Supybot arises from the lack of proper input validation and sanitization. By injecting malicious code through the 'calc' or 'icalc' commands, an attacker can execute arbitrary Python code in the context of the IRC bot. This can lead to unauthorized disclosure of sensitive information or potentially allow the attacker to perform unauthorized actions on the system. The impact of the vulnerability may vary depending on the specific usage and configuration of the affected IRC bot.
How To Fix
Minimum fixed version
3848ae78de45b35c029cc333963d436b9d2f0a35
This is the first release that contains the fix.
pip install --upgrade "limnoria==3848ae78de45b35c029cc333963d436b9d2f0a35"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or remove the Math plugin from their IRC bot configuration until a fixed version is available. This can be achieved by modifying the configuration file or plugin list of the IRC bot. However, this workaround may impact the functionality provided by the Math plugin.
Conclusion
The eval injection vulnerability in the Math plugin of Limnoria and Supybot can have serious consequences, including unauthorized information disclosure and potential unauthorized actions. It is crucial to update to a fixed version of Limnoria or migrate from Supybot to Limnoria. Additionally, implementing proper input validation and sanitization measures in plugins is essential to prevent similar vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for limnoria →
FAQ
Limnoria is an open-source Python-based IRC bot framework that provides various features and plugins for IRC communication and automation.
The Math plugin is a plugin for Limnoria that allows users to perform mathematical calculations using IRC commands.
Eval injection is a type of vulnerability where untrusted input is passed to an eval() function or similar construct, allowing arbitrary code execution.
The vulnerability can lead to unauthorized disclosure of sensitive information or potentially allow attackers to perform unauthorized actions on the system running the IRC bot.
To protect your IRC bot, it is recommended to update to a fixed version of Limnoria or Supybot and ensure proper input validation and sanitization in plugins that accept user input.
Related vulnerabilities
Recent vulnerabilities recorded for limnoria.
