CVE-2023-31543
📋 TL;DR
This dependency confusion vulnerability in pipreqs allows attackers to execute arbitrary code by uploading malicious packages to a PyPI repository server. It affects users of pipreqs versions 0.3.0 through 0.4.11 who generate requirements.txt files from Python projects. Attackers can compromise systems during dependency resolution.
💻 Affected Systems
- pipreqs
📦 What is this software?
Pipreqs by Pipreqs Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to steal data, install malware, or pivot to other systems.
Likely Case
Arbitrary code execution in the context of the user running pipreqs, potentially leading to credential theft, data exfiltration, or lateral movement.
If Mitigated
Limited impact if using private PyPI repositories with strict controls and verifying all dependencies before installation.
🎯 Exploit Status
Exploitation requires the attacker to control or compromise a PyPI repository server that the victim uses, or to poison public PyPI with malicious packages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.12
Vendor Advisory: https://github.com/bndr/pipreqs/pull/364
Restart Required: No
Instructions:
1. Update pipreqs using pip: pip install --upgrade pipreqs==0.4.12
2. Verify the version: pipreqs --version
3. Ensure all systems using pipreqs are updated.
🔧 Temporary Workarounds
Use private PyPI repository
allConfigure pipreqs to use only trusted, private PyPI repositories with strict package vetting.
export PIP_INDEX_URL=https://your-private-pypi/simple/
Disable pipreqs dependency resolution
allManually create requirements.txt files instead of using pipreqs automated scanning.
🧯 If You Can't Patch
- Restrict network access to only trusted PyPI repositories using firewall rules or proxy configurations.
- Run pipreqs in isolated containers or sandboxes with minimal privileges and no sensitive data access.
🔍 How to Verify
Check if Vulnerable:
Check pipreqs version: pipreqs --version. If version is between 0.3.0 and 0.4.11 inclusive, system is vulnerable.Check Version:
pipreqs --versionVerify Fix Applied:
Verify pipreqs version is 0.4.12 or higher: pipreqs --version📡 Detection & Monitoring
Log Indicators:
- Unusual PyPI package downloads during pipreqs execution
- Network connections to unexpected PyPI repositories
- Process execution from pipreqs with suspicious arguments
Network Indicators:
- Outbound connections to non-approved PyPI repositories during pipreqs runs
- DNS queries for suspicious package names
SIEM Query:
process.name="pipreqs" AND network.destination.ip NOT IN (trusted_pypi_ips)