CVE-2025-27154
📋 TL;DR
Spotipy versions before 2.25.1 create cache files with overly permissive 644 permissions, exposing Spotify authentication tokens to other users or processes on the same system. Attackers who can read these tokens can perform administrative actions on the associated Spotify accounts. This affects all users of vulnerable Spotipy versions on multi-user systems or shared environments.
💻 Affected Systems
- spotipy
📦 What is this software?
Spotipy by Spotipy Project
⚠️ Risk & Real-World Impact
Worst Case
Full account takeover of Spotify accounts, allowing attackers to modify playlists, access private data, change account settings, or perform unauthorized actions based on token scopes.
Likely Case
Unauthorized access to Spotify account data and limited administrative actions by local users or processes on shared systems.
If Mitigated
No impact if proper file permissions are enforced or the system is single-user with no malicious local users.
🎯 Exploit Status
Exploitation requires local access to read the cache file. Simple cat/read commands can extract tokens from improperly secured cache files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.25.1
Vendor Advisory: https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w599
Restart Required: No
Instructions:
1. Update Spotipy using pip: 'pip install --upgrade spotipy>=2.25.1'. 2. Verify the new cache files are created with 600 permissions. 3. Manually secure existing cache files if needed.
🔧 Temporary Workarounds
Manual permission hardening
linuxManually change permissions on existing Spotipy cache files to 600
chmod 600 ~/.cache/spotipy/*.cache
find ~/.cache/spotipy -name "*.cache" -exec chmod 600 {} \;
Custom CacheHandler implementation
allOverride CacheHandler to enforce strict permissions
Create custom class inheriting from CacheHandler with proper os.chmod() calls
🧯 If You Can't Patch
- Manually set permissions on all Spotipy cache files to 600 and monitor for new files
- Run Spotipy in isolated environments or containers with no other users
🔍 How to Verify
Check if Vulnerable:
Check Spotipy version: 'pip show spotipy' and verify it's <2.25.1. Check cache file permissions: 'ls -la ~/.cache/spotipy/*.cache' - files should not be world-readable.Check Version:
pip show spotipy | grep VersionVerify Fix Applied:
After upgrade, create new cache file by authenticating, then verify permissions: 'ls -la ~/.cache/spotipy/*.cache' should show 600 permissions.📡 Detection & Monitoring
Log Indicators:
- Unusual Spotify API calls from unexpected locations
- Multiple authentication events from same token
Network Indicators:
- Spotify API requests from unexpected IPs or user agents
SIEM Query:
source="spotify_api" AND (user_agent!="expected_agent" OR src_ip NOT IN allowed_ips)🔗 References
- https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98
- https://github.com/spotipy-dev/spotipy/commit/1ca453f6ef87a2a9e9876f52b6cb38d13532ccf2
- https://github.com/spotipy-dev/spotipy/releases/tag/2.25.1
- https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w599
- https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w599
