CVE-2023-39523 ScanCode.io command injection in docker image fetch process
Attackers can inject malicious commands via the docker_reference parameter in ScanCode.io, leading to code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39523?
CVE-2023-39523 is a medium-severity command injection vulnerability in nexB scancode.io, published on 7 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append malicious commands in the `docker_reference` parameter.
In the function `scanpipe/pipes/fetch.py:fetch_docker_image` the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`. However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of `docker://;`, it would allow appending malicious commands.
Version 32.5.1 contains a patch for this issue. The `docker_reference` input should be sanitized to avoid command injections and, as a workaround, one may avoid creating commands with user controlled input directly.
Weakness: CWE-77
Which versions are affected by CVE-2023-39523?
3 open source packages ship an affected version, including scancodeio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
scancodeio PyPI | All versions | 32.5.1 |
scancodeio PyPI | All versions | 32.5.1 |
scancodeio PyPI | All versions | 32.5.1 |
Products include Nexb Scancode.io.
How do I fix CVE-2023-39523?
Upgrade scancodeio to 32.5.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-39523 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39523 exists.
Other vulnerabilities in nexB scancode.io
Sources
Also known as GHSA-2ggp-cmvm-f62f, PYSEC-2026-1904.