EIQ-2020-0015

EIQ-2020-0015

CVE-2019-20916

pip can enable directory traversal

02 Dec 2020

3 - HIGH

7.5

Planned for 2.10.0

pip versions 19.1.1 and earlier can enable directory traversal.

In the _internal/download.py file, the _download_http_url function allows the filename directive of the Content-Disposition response header to hold a URL path pointing to a file as a value.
In pip versions 19.1.1 and earlier, URLs in the filename directive of the Content-Disposition response header are not properly sanitized.
This makes it possible to include ../ sequences in the file path.

By exploiting this vulnerability, potential attackers can break out of the web server's root directory, and they can access files in other directories.
They might be able to view restricted files, or to execute commands on the targeted machine.

To exploit the vulnerability, a potential attacker would need to carry out a privilege escalation attack to obtain the following access rights:

• SSH access to the server hosting the platform.

• SSH access to the target platform instance.

To mitigate this vulnerability:

• Do not install any assets from unstrusted sources.

2.8.0 and earlier.

For more information, see:

• CVE-2019-20916

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

• GitHub issue reporting the vulnerability

   This section is not visible to users accessing the public docs, it's for internal reference   

See also:

• SNYK-PYTHON-PIP-609855

• TP 48351

• Slack convo in engineering-backend channel