CVSS v3 Base Metrics:

• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Scope: Unchanged
• Confidentiality: None
• Integrity: High
• Availability: None

Technical Analysis

The Mechanism

The function requests.utils.extract_zipped_paths() is designed to extract members from a zip archive (often used for CA bundles in zipapp environments). The vulnerable logic follows these steps:

1. Predictable Target: It joins the system temp directory with the basename of the zip member (e.g., /tmp/cacert.pem).
2. Insecure Check: It uses if not os.path.exists(extracted_path) to decide whether to extract the file.
3. Path Return: If the file exists, it immediately returns the path without ensuring the file was created by the current process or checking its content.

Root Cause Analysis

In requests/utils.py, the logic is implemented as follows:

Impact & Exploitation

A Local Attacker with low privileges can exploit this by pre-creating a malicious file (e.g., a forged CA bundle) at the predictable path in /tmp. When a victim (user interaction required) runs an application that invokes this utility:

1. The utility sees the file already exists.
2. The utility skips extraction and returns the path to the malicious file.
3. The victim application loads the attacker's data, leading to a High Integrity compromise (e.g., loading a forged trust store).

Proof of Concept (Standalone)

The following script demonstrates the vulnerability by showing how the utility reuses a pre-existing "fake" file instead of the legitimate one from the archive.

Remediation

The issue is addressed in version 2.33.0. The fix involves transitioning to importlib.resources to handle zipped resources more securely, ensuring that extractions occur in randomized, non-predictable directories and avoiding the reuse of existing files in shared world-writable directories.