Command injection in _wget_download

Vulnerability

Description

The vulnerability resides in the _wget_download function within PaddlePaddle, a deep learning framework. Prior to version 2.6.0, this function constructs a shell command by directly concatenating a user-supplied URL with the wget command, without any sanitization or validation of the URL parameter [4]. This lack of input validation allows an attacker to inject arbitrary shell commands via a crafted URL, leveraging Python's subprocess.Popen with shell=True [1][4].

Exploitation

To exploit this vulnerability, an attacker must be able to control the URL passed to the _get_download or _wget_download function. This can occur through scenarios where the framework downloads model files or other resources from user-specified URLs. The function does not require authentication or special privileges beyond what the application runs as. By providing a URL containing shell metacharacters (e.g., backticks, semicolons, or command substitution), an attacker can execute arbitrary OS commands on the system running PaddlePaddle [1][2][4].

Impact

Successful exploitation results in arbitrary command execution on the underlying operating system. This can lead to full system compromise, including unauthorized access to data, installation of malware, or pivoting to other systems on the same network. The severity is reflected in the high CVSS score, as the attack complexity is low and no authentication is required [2].

Mitigation

The vulnerability was fixed in PaddlePaddle version 2.6.0. The patch, visible in commit c5f6862, introduces URL parsing and validation to ensure that only HTTP and HTTPS schemes are accepted, effectively preventing command injection via the _wget_download function [4]. Users are strongly advised to upgrade to version 2.6.0 or later. No workaround is available for earlier versions [1][2].