PyInstaller up to 3.5 on Windows Onefile Mode TempPath unnecessary privileges

Summaryinfo

A vulnerability identified as critical has been detected in PyInstaller up to 3.5 on Windows. The impacted element is an unknown function of the component Onefile Mode. The manipulation of the argument TempPath leads to unnecessary privileges. This vulnerability is documented as CVE-2019-16784. The attack needs to be performed locally. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in PyInstaller up to 3.5 on Windows. It has been rated as critical. This issue affects some unknown functionality of the component Onefile Mode. The manipulation of the argument TempPath with an unknown input leads to a unnecessary privileges vulnerability. Using CWE to declare the problem leads to CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user (at least more than the current one) which have his "TempPath" resolving to a world writable directory. This is the case for example if the software is launched as a service or as a scheduled task using a system account (TempPath will be C:\Windows\Temp). In order to be exploitable the software has to be (re)started after the attacker launch the exploit program, so for a service launched at startup, a service restart is needed (e.g. after a crash or an upgrade).

The weakness was released 01/14/2020 (GitHub Repository). The advisory is shared at github.com. The identification of this vulnerability is CVE-2019-16784 since 09/24/2019. The exploitation is known to be difficult. An attack has to be approached locally. A simple authentication is required for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 3.6 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• PyInstaller

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5

Website

• Product: https://github.com/pyinstaller/pyinstaller/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion