CVE-2023-43364 Searchor CLI's Search vulnerable to Arbitrary Code using Eval
Attackers can execute arbitrary code via CLI input in the Searchor library due to unsafe eval usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-43364?
CVE-2023-43364 is a critical code injection vulnerability in n/a, published on 12 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
Which versions are affected by CVE-2023-43364?
3 open source packages ship an affected version, including searchor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
searchor PyPI | All versions | 2.4.2 |
searchor PyPI | All versions | 2.4.2 |
searchor PyPI | All versions | 2.4.2 |
Products include Arjunsharda Searchor.
How do I fix CVE-2023-43364?
Upgrade searchor to 2.4.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-43364 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-43364 exists.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-66m2-493m-crh2, PYSEC-2023-262.