Vulnerability CVE-2018-17793

Vulnerability CVE-2018-17793

Published: 2018-09-30

Description:

DISPUTED Virtualenv 16.0.0 allows a sandbox escape via "python $(bash >&2)" and "python $(rbash >&2)" commands. NOTE: the software maintainer disputes this because the Python interpreter in a virtualenv is supposed to be able to execute arbitrary code.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	virtualenv 16.0.0 Sandbox Escape	vr_system	05.10.2018

Type:

CWE-254

(Security Features)

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
10/10	10/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
Virtualenv -> Virtualenv

References:

https://github.com/pypa/virtualenv/issues/1207

https://www.exploit-db.com/exploits/45528/

Copyright 2024, cxsecurity.com