CVE-2024-27763: XPixelGroup BasicSR Command Injection Vulnerability
Summary
CVE-2024-27763: XPixelGroup BasicSR Command Injection. Affects basicsr versions < 1.4.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XPixelGroup BasicSR is an open-source image super-resolution package available on PyPI. It is designed to enhance the quality of images using deep learning techniques. The package is widely used in various applications requiring image processing. However, versions up to 1.4.2 are vulnerable to a command injection issue that can lead to unauthorized code execution under specific conditions.
Vulnerability Detail
The vulnerability arises from the mishandling of the SLURM_NODELIST environment variable in XPixelGroup BasicSR versions up to 1.4.2. When the command 'scontrol show hostname' is executed, it can be manipulated by an attacker to execute arbitrary code. This could lead to severe consequences, including unauthorized access to the system and potential data breaches. The vulnerability is particularly concerning in environments where SLURM is used for job scheduling, as it could be exploited by users with limited privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can unset the SLURM_NODELIST environment variable before executing any commands that rely on it. This can be done by running the following command in your terminal: 'unset SLURM_NODELIST'. However, this may affect the functionality of applications that depend on this variable.
Conclusion
The command injection vulnerability in XPixelGroup BasicSR poses a significant risk to users of versions up to 1.4.2. It is crucial to update to the latest version to protect against potential exploitation. Additionally, users should consider implementing the suggested workaround until they can apply the patch.
See every vulnerability recorded for basicsr →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Versions of BasicSR up to and including 1.4.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized code execution, allowing attackers to gain access to sensitive data or control over the affected system.
Yes, a patch is available in version 1.4.3 of BasicSR. It is recommended to update to this version to mitigate the risk.
