CVE-2023-43364

Vulnerability

Overview

In Searchor versions prior to 2.4.2, the main.py file uses the Python eval() function on user-supplied command-line interface (CLI) input. Specifically, the search function constructs a string using the user-provided query argument and passes it directly to eval(), as shown in the source code: eval(f"Engine.{engine}.search('{query}', copy_url={copy}, open_web={open})") [1][2][4]. This design flaw allows an attacker to inject arbitrary Python expressions.

Exploitation

The vulnerability is exploitable through the CLI interface without any authentication. An attacker can supply a malicious query string that includes Python code, such as __import__('os').system('') or __import__('os').popen('').read(), which will be executed by eval() [4]. The attack requires only that the attacker can invoke the Searchor CLI, making it accessible to anyone with local or remote access to the command line.

Impact

Successful exploitation results in arbitrary command execution on the host system with the privileges of the user running Searchor. This can lead to full system compromise, data exfiltration, or further lateral movement within the network [3][4]. The vulnerability is publicly documented with a proof-of-concept exploit, increasing the risk of active exploitation.

Mitigation

The issue is fixed in Searchor version 2.4.2. Users are strongly advised to upgrade immediately. No workarounds are available; the only remediation is to apply the patch [1][4]. The vulnerability has been assigned CVE-2023-43364 and is tracked in the PyPA advisory database [3].