Executive brief
tqdm is a popular Python library used to display progress bars in command-line applications. A security flaw in how the library checks its own version allows a local attacker to execute malicious code on a user's system. This occurs if a user runs a Python script using tqdm while their terminal is inside a specially crafted, malicious folder (such as a downloaded Git repository).
Technical details
The vulnerability exists in the tqdm._version module, which automatically executes 'git log -n 1 --oneline' upon import to determine the software version. Because git prioritizes repository-specific configuration files found in the current working directory, an attacker can place a malicious .git/config file in a directory and entice a user to run a Python script from that location. By setting parameters such as 'gpg.program' or 'log.showSignature' within the local git config, the attacker can trigger the execution of arbitrary binaries or scripts when tqdm attempts to run the git command. This is a local code execution vulnerability that requires the victim to have their current working directory set to the attacker-controlled path. The issue was resolved in version 4.23.3.
Affected products
- tqdm project tqdm 4.4.1, 4.10, and versions prior to 4.23.3
Timeline
- 2016-12-25: disclosed: Issue reported on GitHub
- 2016-12-28: other: CVE assigned
- 2017-01-19: advisory: NVD publication date
- 2018-07-18: patched: Gentoo advisory indicates fix in 4.23.3