astropy vulnerable to RCE in TranformGraph().to_dot_graph function

Vulnerability

Description

CVE-2023-41334 is a remote code execution vulnerability in the Astropy core package version 5.3.2. The flaw resides in the TransformGraph().to_dot_graph function, where improper input validation in the savelayout argument allows a malicious user to supply a command or script file path. This value is placed as the first element in a list of arguments passed to subprocess.Popen, leading to execution of the attacker-controlled command despite subsequent errors being raised [1][4].

Exploitation

An attacker can exploit this by providing a shell script or command as the savelayout parameter when calling to_dot_graph. The supplied value becomes the first argument in the subprocess call, which is executed before the dot graph processing fails. A proof-of-concept demonstrates that a script placed in /tmp/script is run, writing a file with attacker-controlled content, even though a Python TypeError occurs from the subsequent communicate() call [4]. No special privileges are required beyond calling the vulnerable function.

Impact

Successful exploitation enables arbitrary code execution on the user's machine with the privileges of the Astropy process. An attacker could use this to run malicious scripts, install malware, or exfiltrate data. The impact is limited only by the attacker's ability to invoke the vulnerable function, for example through a crafted input in a Python script or interactive session [1][4].

Mitigation

Version 5.3.3 of the Astropy core package patched this vulnerability by fixing the input validation in to_dot_graph. Users should upgrade to version 5.3.3 or later immediately. No workarounds other than avoiding the use of savelayout with untrusted input are available for versions prior to 5.3.3 [1][4].