GeezerVison is showing github.com — Undocumented risky behaviour in subprocess module · Issue #101283 · python/cpython
Undocumented risky behaviour in subprocess module #101283DescriptionBug report - Undocumented risky behaviour in subprocess module
When using subprocess.Popen with shell=True on Windows and without a COMSPEC environment variable, a cmd.exe is launched. The problem is the cmd.exe full path is not written, Windows will search the executable in the current directory and in the PATH. If an arbitrary executable file is written to the current directory or to a directory in the PATH, it can be run instead of the real cmd.exe.
See the code here and a POC here.
- This risky behaviour can be patched by replacing
cmd.exe string by C:\WINDOWS\system32\cmd.exe.
- If the behavior was chosen by python developers, it should be documented.
Linked PRs
Reacted by Oleg Iarygin and Raj Patnaik Activityeryksun commented on Jan 24, 2023 FYI, subprocess.Popen should never find "cmd.exe" in PATH. We call CreateProcessW(), which always searches the application directory and system directories before it searches PATH.
CreateProcessW() may also check the current directory immediately after the application directory and before the system directories. This unsafe behavior can be prevented by defining the environment variable NoDefaultCurrentDirectoryInExePath. This environment variable has been supported for over 15 years now, since Windows Vista. Our implementation of shutil.which() should honor this security feature by calling NeedCurrentDirectoryForExePathW().
Note that if NoDefaultCurrentDirectoryInExePath is defined, the current directory is still included in the search path if the name is a relative path that includes backslashes (e.g. "Scripts\eggs.exe"), but not if it only includes forward slashes (e.g. "Scripts/eggs.exe"). Note also that the application directory takes precedence over the current directory in this case (e.g. if the application directory is "C:\Program Files\Python311", then "Scripts\eggs.exe" will resolve to "C:\Program Files\Python311\Scripts\eggs.exe" if it exists).
If you define NoDefaultCurrentDirectoryInExePath, the current directory can be added explicitly as a "." entry at the end of either the system or user PATH. I add "." to the end of the user PATH because some apps and scripts still depend on finding binaries and scripts in the current directory, but I won't cater to a bad actor that expects the current directory to be searched before system directories. Reacted by Maurice Lambert gpshead commented on Jan 24, 2023 FYI - this originally came in as a security report to PSRT. I redirected the reporter here (thanks for reporting this!) as this didn't seem serious enough to be embargoed. I'm still tagging it as such and aiming for a full set of backports as it feels like a good idea. Reacted by Maurice Lambert zooba commented on Feb 9, 2023 Fully merged, and all the fixes should be in (I hope). Thanks all! Reacted by Oleg Iarygin, Jeff Rouse and Maurice Lambert added a commit that references this issue on Feb 9, 2023gh-101283: Fix 'versionchanged' for the shell=True fallback on Window…
MetadataMetadataStatusShow more project fields
DevelopmentNo branches or pull requestsIssue actions
|