CVE-2023-41334
📋 TL;DR
This vulnerability in Astropy allows remote code execution through improper input validation in the TransformGraph().to_dot_graph function. An attacker can inject malicious commands via the savelayout argument, which get executed despite an error being raised. Users of Astropy 5.3.2 are affected.
💻 Affected Systems
- Astropy
📦 What is this software?
Astropy by Astropy
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining remote code execution, potentially leading to data theft, system takeover, or lateral movement.
Likely Case
Limited code execution in the context of the Astropy application, potentially allowing file system access, data exfiltration, or further exploitation.
If Mitigated
No impact if the vulnerable function is not called or if input validation prevents exploitation.
🎯 Exploit Status
Exploitation requires the vulnerable function to be called with attacker-controlled input. The advisory provides technical details but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.3.3
Vendor Advisory: https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf
Restart Required: No
Instructions:
1. Upgrade Astropy using pip: pip install --upgrade astropy==5.3.3
2. Verify the version: python -c "import astropy; print(astropy.__version__)"
3. Ensure the version shows 5.3.3 or higher.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize all user input passed to the savelayout parameter of TransformGraph().to_dot_graph function.
Function Restriction
allAvoid using TransformGraph().to_dot_graph with untrusted input or disable the function if not needed.
🧯 If You Can't Patch
- Implement strict input validation for the savelayout parameter to prevent command injection.
- Restrict access to systems using vulnerable Astropy versions and monitor for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check Astropy version: python -c "import astropy; print(astropy.__version__)". If version is 5.3.2, the system is vulnerable.Check Version:
python -c "import astropy; print(astropy.__version__)"Verify Fix Applied:
After patching, verify version is 5.3.3 or higher using the same command.📡 Detection & Monitoring
Log Indicators:
- Unexpected subprocess executions from Astropy processes
- Error logs related to TransformGraph().to_dot_graph with unusual arguments
Network Indicators:
- Outbound connections from Astropy processes to unexpected destinations
SIEM Query:
process_name:"python" AND command_line:"astropy" AND (command_line:"subprocess" OR command_line:"Popen")🔗 References
- https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539
- https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5
- https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf
- https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539
- https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5
- https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf
