Skip to content

Pipenv's requirements.txt parsing allows malicious index url in comments

High
frostming published GHSA-qc9x-gjcv-465w Jan 8, 2022

Package

pip pipenv (pip)

Affected versions

>= 2018.10.9, <=2021.11.23

Patched versions

2022.1.8

Description

Issue Summary

Due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file (e.g. with "pipenv install -r requirements.txt") to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems.

Impact

The impact of successful exploitation is severe/critical.

If an attacker is able to hide a malicious --index-url option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). Exploitation using this technique would be relatively simple to achieve for an attacker with basic knowledge of Python, as the attacker can simply build a source distribution for any of the packages specified in the requirements file, and embed arbitrary malicious code in the setup.py file. When pip installs from a source distribution, any code in the setup.py is executed by the install process.

Basic attacks might use the initial RCE triggered when a victim installs the attacker's malicious package to steal credentials from the victim's host, leach the host's resources to mine cryptocurrency, or install exploit kits or other malware. More sophisticated attackers may use more advanced techniques to persist access to the victim's host, hide or remove evidence of their attack by deleting references to the malicious index server in the Pipfile and Pipfile.lock generated by pipenv or other potential indicators of compromise. Highly sophisticated attackers could attempt to pivot to additional targets from the initial compromised host, and might leverage any exposed credentials in the compromised host environment or implicit authorization granted to the host to gain privileged access to other systems or resources, such as source repositories or package registries.

Likelihood

The overall likelihood of exploitation is low to moderate depending on a range of factors.

The primary hurdle to successful exploitation of this vulnerability depends on an attacker's ability to surreptitiously insert a specially crafted string into a requirements.txt file which will be installed by a victim (or victims). Unfortunately, because the attacker can insert this string into a comment, the attacker's ability to evade suspicion is greatly increased, and they may even be able to hide the initial payload in plain sight if a victim assumes that comments will be ignored by pipenv as expected.

In many common usage contexts — for example in environments where a requirements file is used to lock or "freeze" dependency versions for reproducible builds — requirements files can often become quite large, particularly when leveraging pip's integrity checking, which requires every dependency specified in the requirements file to includes hashes for all of its distribution files. In such cases, a malicious actor might mask an exploitation attempt by opening a pull request ostensibly to update or "bump" the project's dependencies to their latest versions, but surreptitiously insert a malicious —index-url option amidst the many other changes associated with updating the dependencies in a lock file. As these dependency updates often result in hundreds or even thousands of changes spread across the requirements file and are not easy to review manually, such an attack could be difficult to identify or prevent without tools or other mitigating controls.

Moreover, because the argparse module is used to parse the --index-url, --extra-index-url, and --trusted-host options, an attacker's ability to obfuscate their payload and hide their malicious intent is even more greatly enhanced, as the attacker may use abbreviated option names, which are supported by default with argparse. For example, an attacker can insert the string, "--t pypi.org" into a comment anywhere in the requirements file, which will automatically be expanded to "--trusted-host pypi.org" during processing by pipenv. This "--trusted-host pypi.org" option will disable SSL/TLS validation when pipenv attempts to connect to the default/official package index server (https://pypi.org/simple), and could allow a malicious index server to pose as the pipi.org index server in a man-in-the-middle attack.

Setting up the malicious index server to serve compromised package versions is relatively simple, even for a non-sophisticated attacker. As pip uses a simple directory format for serving packages, the malicious packages simply need to be placed in the correct folder structure and served using an HTTP server with autoindex enabled (e.g. python3 -m http.server).

Packaging up the exploit code into the malicious package versions would also be trivial for an attacker with basic knowledge of Python development, as the attacker can simply clone the source code for any of the packages specified in the requirements file, embed their malicious exploit code in the cloned package's setup.py file, and then build a source distribution of the package. When pip installs a package from a source distribution, any code in the setup.py is executed by the install process.

Additional Context & Details

According to the requirements file format specification (https://pip.pypa.io/en/stable/reference/requirements-file-format/#comments), any lines which begin with a "#" character, and/or any text in a line following a whitespace and a "#" character, should be interpreted as a comment which will be removed/ignored during processing of the requirements file.

However, due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file (e.g. with "pipenv install -r requirements.txt") to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker is then able to gain arbitrary remote code execution on the victims' systems.

The vulnerable requirements file parsing code is in the parse_indexes(str: line) function of the pipenv.utils module:

pipenv/pipenv/utils.py

Lines 2061 to 2078 in cdde3f7

def parse_indexes(line):
from argparse import ArgumentParser
parser = ArgumentParser("indexes")
parser.add_argument(
"--index", "-i", "--index-url",
metavar="index_url", action="store", nargs="?",
)
parser.add_argument(
"--extra-index-url", "--extra-index",
metavar="extra_indexes", action="append",
)
parser.add_argument("--trusted-host", metavar="trusted_hosts", action="append")
args, remainder = parser.parse_known_args(line.split())
index = [] if not args.index else [args.index]
extra_indexes = [] if not args.extra_index_url else args.extra_index_url
indexes = index + extra_indexes
trusted_hosts = args.trusted_host if args.trusted_host else []
return indexes, trusted_hosts, remainder

This function is called iteratively on each line of a requirements file, and uses the argparse module to find and process --index-url, --extra-index-url, and --trusted-host options (and variations thereof). However, it does not ignore these options when they appear in comments, or validate that these options appear on their own lines as required by the requirements file specification (see: https://pip.pypa.io/en/stable/reference/requirements-file-format/#global-options). The options can also be abbreviated due to default behavior provided by the argparse.ArgumentParser object used to parse these options in the requirements file, so that --trusted-host and --t will be treated as equivalent by pipenv, for example.

For more information

If you have any questions or comments about this advisory:

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

CVE ID

CVE-2022-21668

Credits