CVE-2023-32309 Arbitrary file inclusion with the pymdowm-snippets extension
Attackers can read arbitrary files on the host via directory traversal in the PyMdown Snippets extension if it processes untrusted user input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32309?
CVE-2023-32309 is a high-severity path traversal vulnerability in facelessuser pymdown-extensions, published on 15 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `--8<-- "../../../../etc/passwd"`. Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed. This issue has been addressed in version 10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering input.
Weakness: CWE-22
Which versions are affected by CVE-2023-32309?
3 open source packages ship an affected version, including pymdown-extensions. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pymdown-extensions PyPI | From 1.5 | 10.0 |
pymdown-extensions PyPI | From 1.5 | 10.0 |
pymdown-extensions PyPI | From 1.5 | 10.0 |
Products include Facelessuser Pymdown Extensions.
How do I fix CVE-2023-32309?
Upgrade pymdown-extensions to 10.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-32309 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32309 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in facelessuser pymdown-extensions
Sources
Also known as DEBIAN-CVE-2023-32309, GHSA-jh85-wwv9-24hv, PYSEC-2026-1824, UBUNTU-CVE-2023-32309.