Impact
A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to.
A user is affected if all the following are satisfied:
- The user runs an application containing either
matplotlib or win32com.
- The application is ran as administrator (or at least a user with higher privileges than the attacker).
- The user's temporary directory is not locked to that specific user (most likely due to
TMP/TEMP environment variables pointing to an unprotected, arbitrary, non default location).
- Either:
- The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between
shutil.rmtree()'s builtin symlink check and the deletion itself
- The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links
Patches
The vulnerability has been addressed in pyinstaller/pyinstaller#7827 which corresponds to pyinstaller >= 5.13.1
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No workaround, although the attack complexity becomes much higher if the application is built with Python >= 3.8.0.
References
Impact
A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to.
A user is affected if all the following are satisfied:
matplotliborwin32com.TMP/TEMPenvironment variables pointing to an unprotected, arbitrary, non default location).shutil.rmtree()'s builtin symlink check and the deletion itselfPatches
The vulnerability has been addressed in pyinstaller/pyinstaller#7827 which corresponds to
pyinstaller >= 5.13.1Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No workaround, although the attack complexity becomes much higher if the application is built with Python >= 3.8.0.
References