Improper Control of Generation of Code ('Code Injection') (CWE-94)
Pillow through version 10.1.0 contains a vulnerability that allows arbitrary code execution via the environment parameter in PIL.ImageMath.eval. This is distinct from the previously identified CVE-2022-22817, which pertained to the expression parameter.
This vulnerability could allow an attacker to execute arbitrary code within the context of the application using Pillow. The potential impacts include: 1. Unauthorized access to the system 2. Data theft or manipulation 3. Further system compromise 4. Potential for lateral movement within the network The vulnerability has a CVSS v3.1 base score of 8.1, classified as "HIGH" severity, indicating a significant risk that should be prioritized for patching. The CVSS vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates: - Network attack vector (AV:N) - High attack complexity (AC:H) - No privileges required (PR:N) - No user interaction required (UI:N) - Unchanged scope (S:U) - High impact on confidentiality, integrity, and availability (C:H/I:H/A:H) This scoring suggests that while the attack is complex to execute, it can be initiated remotely without user interaction or privileges, and can have severe consequences if successful.
One proof-of-concept exploit is available on github.io. There is no evidence of proof of exploitation at the moment.
A patch is available. Oracle has released a patch for this vulnerability, which was added on July 16, 2024. The patch can be found in the Oracle Critical Patch Update for July 2024, available at https://www.oracle.com/security-alerts/cpujul2024.html. Additionally, users should update Pillow to a version newer than 10.1.0 as soon as possible.
To mitigate this vulnerability: 1. Update Pillow to a version newer than 10.1.0 as soon as possible. 2. Apply the Oracle patch if you're using an Oracle product that incorporates Pillow. 3. If immediate updating is not possible, consider temporarily disabling or restricting access to functionality that uses PIL.ImageMath.eval, especially if it processes user-controlled input. 4. Implement input validation and sanitization for any data passed to PIL.ImageMath.eval. 5. Monitor system logs for any suspicious activities related to Pillow usage. 6. Use security tools like Qualys or Nessus, which can detect this vulnerability, to scan your systems regularly. 7. Keep all systems and dependencies up to date with the latest security patches. Prioritize patching efforts based on the criticality of affected systems and their exposure to potential attackers. Systems directly accessible from the internet or processing untrusted input should be addressed first.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD published the first details for CVE-2023-50447
Feedly found the first article mentioning CVE-2023-50447. See article
Feedly estimated the CVSS score as MEDIUM
Feedly estimated the CVSS score as HIGH
Detection for the vulnerability has been added to Qualys (996819)
RedHat CVE advisory released a security advisory (CVE-2023-50447).
Detection for the vulnerability has been added to Nessus (189400)
EPSS Score was set to: 0.05% (Percentile: 13.8%)