Executive brief
Paste Script is a Python-based web development tool used for running and managing web applications. When running with root privileges, it fails to properly set group membership restrictions, allowing attackers to bypass intended file-access controls and potentially read or modify files they should not be able to access.
Technical details
This vulnerability is an improper privilege management issue in Paste Script versions 1.7.5 and earlier (and Paste library versions 1.7.5 and earlier). The root cause is that the application does not correctly drop or set group memberships during execution with root privileges. An attacker with remote access to a web application built on these libraries can bypass file-access restrictions by leveraging the web application's local filesystem access. The vulnerability requires the application to run with root privileges and be remotely reachable. Patches are available: Paste Script 2.0.1+ and Paste 1.7.5.1+.
Affected products
- Python Packaging Authority pastescript 0–1.7.5 (fixed in 2.0.1)
- Python Packaging Authority Paste 0–1.7.5 (fixed in 1.7.5.1)
Timeline
- 2012-05-01: disclosed: CVE-2012-0878 published on NVD
- 2012: patched: Fixes available in Paste Script 2.0.1+ and Paste 1.7.5.1+
- 2022-05-17: advisory: GitHub advisory GHSA-27px-qpmj-qg38 published