Critical, CVSS 9.3PyPIAmendedPublished
pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string
CVE-2024-23346 · GHSA-vgv8-5cpj-qj2f
- Affected
- PyPI pymatgen < 2024.2.20
- Fixed in
- 2024.2.20· Vendor fix available
- Issue
- A critical security vulnerability exists in the JonesFaithfulTransformation.fromtransformationstr() method within the pymatgen library. This method insecurely utilizes eval() for processing input, enabling execution of arbitrary code when parsing untrusted input. This can be exploited when parsing a maliciously-created CIF file. Details The cause of the vulnerability is in pymatgen/symmetry/settings.py#L97C1-L111C108. The flawed code segment involves a regular expression operation followed by the use of eval(). Vulnerable code The use of eval, even with builtins set to None, is still a security risk. The BuiltinImporter class can be recovered with subclass traversal. PoC The vulnerability can be exploited as follows: Create a file vuln.cif with the following contents: Then, parse the cif file with the following code: Credits This vulnerability was found and disclosed by William Khem-Marquez.
Recommended action: Upgrade to 2024.2.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.