GitHub Advisoryadvisory · PyPI

GHSA-66m2-493m-crh2 Searchor CLI's Search vulnerable to Arbitrary Code using Eval

CRITICAL Published 2023-09-25 Modified 2024-10-09 Official page ↗
Aliases
CVE-2023-43364
Ecosystem
PyPI
Packages
searchor
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74, CWE-94
Reviewed
2023-09-25

Affected packages

• PyPI searchor: < 2.4.2 → fixed in 2.4.2

Description

An issue in Arjun Sharda's Searchor before version v.2.4.2 allows an attacker to execute arbitrary code via a crafted script to the eval() function in Searchor's src/searchor/main.py file, affecting the search feature in Searchor's CLI (Command Line Interface). Impact Versions equal to, or below 2.4.1 are affected. Patches Versions above, or equal to 2.4.2 have patched the vulnerability. References https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit- https://github.com/jonnyzar/POC-Searchor-2.4.2 https://github.com/ArjunSharda/Searchor/pull/130

Related

Alias · CVE (1)

  • CVE-2023-43364 main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References