CVE-2022-34064

Vulnerability

The Zibal package on PyPI, a payment gateway wrapper, was discovered to contain a code execution backdoor in version 1.0.0 [1]. The malicious code is embedded within the package's source, allowing arbitrary commands to be executed when the package is installed or used.

Exploitation

An attacker who has published the backdoored package (version 1.0.0) can exploit it by having users install it via pip. No additional authentication or access is required by the attacker beyond making the package available. Users who install zibal version 1.0.0 will unknowingly execute the backdoor, which then communicates with the attacker-controlled server.

Impact

Successful exploitation allows the attacker to access sensitive user information and digital currency keys, as well as escalate privileges [1]. This could lead to full compromise of the user's system and theft of cryptocurrency assets.

Mitigation

Mitigation was not published in the available references [1]. Users should avoid using version 1.0.0 and instead use a later version if available, or remove the package entirely. The PyPI project page shows version 1.1.0 as the latest, which may have been posted before the backdoor was discovered; users are advised to audit any version of this package.