Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-x4x5-jv3x-9c7m

Опубликовано: 20 мар. 2024
Источник: github
Github: Прошло ревью
CVSS3: 5.3

Описание

qiskit_ibm_runtime.RuntimeDecoder can execute arbitrary code

Summary

deserializing json data using qiskit_ibm_runtime.RuntimeDecoder can be made to execute arbitrary code given a correctly formatted input string

Details

RuntimeDecoder is supposed to be able to deserialize JSON strings containing various special types encoded via RuntimeEncoder. However, one can structure a malicious payload to cause the decoder to spawn a subprocess and execute arbitrary code, exploiting this block of code: https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159

PoC

malicious_data = { "__type__": "settings", "__module__": "subprocess", "__class__": "Popen", "__value__": { "args": ["echo", "hi"] }, } json_str = json.dumps(malicious_data) _ = json.loads(json_str, cls=qiskit_ibm_runtime.RuntimeDecoder) # prints "hi" to the terminal

(where obviously "echo hi" can be replaced with something much more malicious)

notably the following also makes it through the runtime API, with malicious_data serialized client-side via RuntimeEncoder (and therefore presumably deserialized server-side via RuntimeDecoder?)

service = qiskit_ibm_runtime(<ibm_cloud_credentials>) job = service.run("qasm3-runner", malicious_data) print(job.status()) # prints "JobStatus.QUEUED"

Impact

i don't know if qiskit_ibm_runtime.RuntimeDecoder is used server-side so this may or may not be a serious vulnerability on your end (however it's definitely a security hole for anyone using the library to deserialize third-party data)

Пакеты

Наименование

qiskit-ibm-runtime

pip
Затронутые версииВерсия исправления

>= 0.1.0, < 0.21.2

0.21.2

EPSS

Процентиль: 19%
0.00061
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-502

Связанные уязвимости

CVSS3: 5.3
nvd
почти 2 года назад

Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.

EPSS

Процентиль: 19%
0.00061
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-502