GHSA-5rjg-fvgr-3xxf

Опубликовано: 19 мая 2025

Источник: github

Github: Прошло ревью

CVSS4: 7.7

Описание

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Summary

A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1

Details

def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name)

Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88

os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.

Risk Assessment

As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like https://github.com/advisories/GHSA-r9hx-vwmv-q579, and as described by POC 4 in https://github.com/advisories/GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.

Impact

An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

References

https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 https://github.com/pypa/setuptools/issues/4946

Ссылки

Пакеты

Наименование

setuptools

pip

Затронутые версииВерсия исправления

< 78.1.1

78.1.1

EPSS

Процентиль: 32%

0.0012

Низкий

7.7 High

CVSS4

CVE ID

CVE-2025-47273

Дефекты

CWE-22

Связанные уязвимости

CVE-2025-47273

CVSS3: 8.8

ubuntu

около 1 месяца назад

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.