CVE-2023-41039 Sandbox escape via various forms of "format" in RestrictedPython
Attackers can escape the RestrictedPython sandbox to read sensitive objects via format string manipulation, requiring an upgrade to secure versions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-41039?
CVE-2023-41039 is a high-severity vulnerability in zopefoundation RestrictedPython, published on 30 Aug 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-74
Which versions are affected by CVE-2023-41039?
5 open source packages ship an affected version, including restrictedpython and RestrictedPython. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
restrictedpython PyPI | All versions | 5.4 |
restrictedpython PyPI | From 6.0 | 6.2, 5.4 |
restrictedpython PyPI | From 6.0 | 6.2 |
RestrictedPython PyPI | All versions | 5.4 |
RestrictedPython PyPI | From 6.0 | 6.2 |
Products include Zope Restrictedpython.
How do I fix CVE-2023-41039?
Upgrade restrictedpython to a fixed version for your release line: 5.4 or 6.2.
Is CVE-2023-41039 being exploited?
There is no known exploitation of CVE-2023-41039 in the wild and no public exploit code.
Other vulnerabilities in zopefoundation RestrictedPython
Sources
Also known as DEBIAN-CVE-2023-41039, GHSA-xjw2-6jm9-rf67, PYSEC-2023-159, UBUNTU-CVE-2023-41039.