CVE-2023-24816 set_term_title command injection in ipython
Attackers can inject shell commands via untrusted input to set_term_title in IPython on Windows without ctypes, requiring library usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-24816?
CVE-2023-24816 is a medium-severity command injection vulnerability in ipython, published on 10 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function `IPython.utils.terminal.set_term_title` be called on Windows in a Python environment where ctypes is not available. The dependency on `ctypes` in `IPython.utils._process_win32` prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool `set_term_title` could be called and hence introduce a vulnerability. Should an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. Users of ipython as a library are advised to upgrade. Users unable to upgrade should ensure that any calls to the `IPython.utils.terminal.set_term_title` function are done with trusted or filtered input.
Which versions are affected by CVE-2023-24816?
3 open source packages ship an affected version, including ipython. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ipython PyPI | All versions | 8.10.0 |
ipython PyPI | All versions | 8.10.0 |
ipython PyPI | All versions | 8.10.0 |
Products include Ipython Ipython.
How do I fix CVE-2023-24816?
Upgrade ipython to 8.10.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-24816 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24816 exists.
Other vulnerabilities in ipython
Sources
Also known as GHSA-29gw-9793-fvw7, PYSEC-2023-17, UBUNTU-CVE-2023-24816.