thanhh23/cve-2024-42992CVE-2024-42992
Python Pip Pandas v2.2.2 has been found to contain an arbitrary file
Pip Pandas (all versions) - <=2.2.2
An arbitrary file read vulnerability exists in the "pandas" library, allowing an attacker to read any file in the file system without restrictions. This vulnerability enables unauthorized access to sensitive files such as "/etc/passwd"
The pandas library provides powerful data manipulation capabilities, including the ability to read data from various file formats. However, it lacks sufficient restrictions on the file path provided as input, allowing malicious users to specify and read arbitrary files. The vulnerability can be demonstrated through the following code snippet:
import pandas as pd
# Attempt to read the /etc/passwd file
try:
# Use pandas to read the file, specifying the colon as a separator
df = pd.read_csv('/etc/passwd', sep=':', header=None)
print(df)
except Exception as e:
print("Error occurred while reading the file:", e)
This code attempts to read the "/etc/passwd" file, which is a critical file on Unix-based systems containing user account information. If the code executes successfully, it prints the contents of this sensitive file.
In certain online or local access scenarios, this can be successfully reproduced. It is especially reproducible in some online environments, such as replyt.com.
python CVE-2024-42992.py
