Georgi Guninski's blog

Potential symlink attack in python3 __pycache__

Not sure if this is vulnerability, but it looks like
classical symlink attack.

In python3, if a script in directory DIR1 does "import another",
then python3 creates directory __pycache__ in DIR1 and puts
some files in __pycache__.

According to our tests, if DIR1/__pycache__ is symlink to something,
then python3 follows the symlink.

We suspect the attacker has little to no control on the created files,
except that the files are created.

Here is an artificial session of root shooting herself in the leg
on ubuntu 20:

root@bialokote:~# python3 --version
Python 3.8.10
root@bialokote:~# cat /tmp/a.py
try:  import joro2
except:  print("error in import (2)")
root@bialokote:~# cat /tmp/joro2.py
print("in joro 2")
blah=0
root@bialokote:~# rm ~/tests/*
root@bialokote:~# rm /tmp/__pycache__ #XXX
root@bialokote:~# ls -l ~/tests
total 0
root@bialokote:~# ln -s ~/tests/ /tmp/__pycache__ #XXX shooting in leg
root@bialokote:~# python3 /tmp/a.py
in joro 2
root@bialokote:~# ls -l ~/tests
total 4
-rw-r--r-- 1 root root 144 Jul 24 16:58 joro2.cpython-38.pyc
root@bialokote:~#

Summary: under certain circumstances, ipython3 may execute
code from the current working directory. This might be a
problem if the current working directory is not trusted.

python3 is safe.

Tested on ubuntu 20.

The following session illustrates it:

joro@bialokote:~/tests/dir2$ pwd
/home/joro/tests/dir2
joro@bialokote:~/tests/dir2$ ipython3 --version
7.13.0
joro@bialokote:~/tests/dir2$ ls ~/tests/dir1
a.py  joro-orig.py  __pycache__
joro@bialokote:~/tests/dir2$ ls ~/tests/dir2
joro.py  __pycache__
joro@bialokote:~/tests/dir2$ cat ~/tests/dir1/a.py
try:  import joro
except:  print("error in import")
joro@bialokote:~/tests/dir2$ cat ~/tests/dir2/joro.py
print("imported joro :)")
joro@bialokote:~/tests/dir2$ ipython3 ~/tests/dir1/a.py
imported joro :)
joro@bialokote:~/tests/dir2$