PSF-2017-8 Environment variables injection in subprocess on Windows
Attackers can inject environment variables or arguments into subprocess calls on Windows, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is PSF-2017-8?
PSF-2017-8 is a command injection vulnerability, published on 22 Jun 2017.
Official description
On Windows, prevent passing invalid environment variables and command arguments to subprocess.Popen.
It is possible to inject an environment variable in subprocess on Windows if a user data is passed to a subprocess via environment variable.
Check for invalid environment (variable names containing '=') and command arguments (containing '\0').
Which versions are affected by PSF-2017-8?
How do I fix PSF-2017-8?
No fix has been published for PSF-2017-8 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is PSF-2017-8 being exploited?
There is no known exploitation of PSF-2017-8 in the wild and no public exploit code.