Another significant security issue has been uncovered in the popular Python Imaging Library (Pillow) and has been assigned CVE-2023-50447. This vulnerability allows for arbitrary code execution via the environment parameter in PIL.ImageMath.eval. This issue affects all versions of Pillow up to and including version 10.1.. This is a separate vulnerability from the recently disclosed CVE-2022-22817, which involved exploitation through the expression parameter instead.

In this post, we will discuss the details of this vulnerability, provide code snippets to demonstrate its exploitation, and highlight important original references for further reading.

Background

Pillow is a popular and powerful open-source library for handling image processing tasks in Python. It is widely used in a variety of applications, including web development, data analysis, and artificial intelligence.

Exploit Details

The vulnerability in Pillow exists in the PIL.ImageMath.eval function, which evaluates a given mathematical expression on an image. When an attacker provides a malicious environment parameter to the eval function, it's possible to achieve arbitrary code execution.

To better understand the issue, let's consider the following code snippet

from PIL import ImageMath

image = ImageMath.eval("im+42", environment={"im": open("img.jpg", "rb")})

In the example above, the ImageMath.eval function takes an expression ("im+42") and an environment parameter (a dictionary containing a mapping of variable names to their respective values). The vulnerability lies in passing an attacker-controlled object (such as a file object in this case) as the value for the variable "im" within the environment parameter. This could allow an attacker to execute arbitrary code, as demonstrated in the following example:

class MaliciousObject:
    def __add__(self, other):
        import os
        os.system("evil_command")  # Arbitrary command execution
        return self

malicious_object = MaliciousObject()
image = ImageMath.eval("im+42", environment={"im": malicious_object})

By creating a custom class (MaliciousObject) that defines the "__add__" method to execute an arbitrary command, we can pass an instance of this class as the value for the "im" variable in the environment parameter. When ImageMath.eval runs the expression, the "__add__" method will be called, and the arbitrary command will be executed.

The vulnerability has been extensively documented and discussed in the following sources

1. Official Pillow GitHub Repository: https://github.com/python-pillow/Pillow
2. Pillow Security Advisory: https://pillow.readthedocs.io/en/stable/releasenotes/10.2..html#pil-imagemath-eval-arbitrary-code-execution
3. NVD Data for CVE-2023-50447: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-50447

Mitigation

To address this vulnerability, users are recommended to update Pillow to version 10.2. or later. This can be done through the Python package manager (pip) using the following command:

pip install --upgrade pillow

It's also essential to ensure that untrusted input is not passed to the PIL.ImageMath.eval function, especially within the environment parameter.

Conclusion

In conclusion, CVE-2023-50447 is a serious vulnerability in the Python Pillow library that allows for arbitrary code execution through the environment parameter of the PIL.ImageMath.eval function. It is crucial for developers and users of the library to update to the latest version and examine their code for instances of this vulnerability. By staying informed and applying proper security practices, the risks associated with this vulnerability can be mitigated effectively.

Timeline

Published on: 01/19/2024 20:15:11 UTC
Last modified on: 03/27/2024 21:15:48 UTC