Malicious code in verint (PyPI)
Summary
MAL-2023-7808: Malicious code in verint (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Verint is a Python package available on PyPI that provides functionality for [add description of package functionality]. It is widely used in [mention specific use cases or industries]. The package is vulnerable to a malicious code injection attack, as a result of which it can execute spyware and information-stealing malware. This vulnerability was discovered by the Checkmarx security team.
Vulnerability Detail
The vulnerability (MAL-2023-7808) in the verint package allows an attacker to inject malicious code into the package. This code can be used to execute spyware and steal sensitive information from the affected system. The malicious code was introduced in version 0 of the package and has been distributed through the PyPI repository. The specific URLs associated with the malicious code are [https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe] and [https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1]. Users who have installed or updated the verint package to version 0 or later are potentially affected.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall verintIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider using alternative packages that provide similar functionality to verint. It is important to thoroughly vet and review the security of any alternative packages before adoption. Additionally, implementing strict access controls, network segmentation, and regular security audits can help minimize the risk of such attacks.
Conclusion
The verint package on PyPI has been found to contain malicious code that can execute spyware and steal sensitive information. Users are advised to remove or uninstall the package from their systems and take necessary steps to mitigate the impact of the vulnerability. Regularly monitoring for security updates and following best practices for package management can help prevent similar incidents in the future. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for verint →
FAQ
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide the Pipfile.lock of your application and the Vulert Playground will analyze it for any open-source vulnerabilities, including this specific verint vulnerability.
The malicious code injected into the verint package can execute spyware and steal sensitive information from the affected system. This can lead to unauthorized access, data breaches, and compromise of sensitive information.
At the time of this report, there is no secure version of the verint package available. It is recommended to remove or uninstall the package until a secure version is released.
While PyPI is a widely used repository for Python packages, it is important to exercise caution and review the security of packages before installation. Regularly monitoring for security updates and following best practices for package management can help mitigate the risk of installing malicious packages.
If you have already installed the verint package, it is recommended to immediately remove or uninstall it from your system. Additionally, scan your system for any signs of compromise and take appropriate actions to mitigate the impact of the attack.
