GHSA-67cx-rhhq-mfhq High severity vulnerability that affects indico
Malicious users can inject LaTeX commands to read local server files, requiring an upgrade to Indico.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-67cx-rhhq-mfhq?
GHSA-67cx-rhhq-mfhq is a code injection vulnerability in indico, published on 11 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Local file disclosure through LaTeX injection
Impact
An external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files (e.g. indico.conf).
As far as we know it is not possible to write files or execute code using this vulnerability.
Patches
You need to update to Indico 2.2.3 as soon as possible. We also released Indico 2.1.10 in case you cannot update to 2.2 for some reason. See https://docs.getindico.io/en/stable/installation/upgrade/ for instructions on how to update.
Workarounds
Setting XELATEX_PATH = None in indico.conf will result in an error when building a PDF, but without being able to run xelatex, the vulnerability cannot be abused.
For more information
If you have any questions or comments about this advisory:
- Open a thread in our forum
- Email us privately at [email protected]
Which versions are affected by GHSA-67cx-rhhq-mfhq?
4 open source packages ship an affected version, including indico.
| Package | Affected | Fixed in |
|---|---|---|
indico PyPI | All versions | 2.1.10 |
indico PyPI | All versions | 2.1.10 |
indico PyPI | From 2.2.0 | 2.2.3 |
indico PyPI | From 2.2.0 | 2.2.3 |
How do I fix GHSA-67cx-rhhq-mfhq?
Upgrade indico to a fixed version for your release line: 2.1.10 or 2.2.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-67cx-rhhq-mfhq being exploited?
There is no known exploitation of GHSA-67cx-rhhq-mfhq in the wild and no public exploit code.