Executive brief
IPython is an interactive Python shell used by data scientists and developers. A command injection vulnerability in its terminal title-setting function allows an attacker to execute arbitrary commands if a user changes into a specially-named directory on Windows systems with a specific Python build lacking ctypes support. This could lead to unauthorized code execution and system compromise.
Technical details
The vulnerability is a command injection (CWE-78, CWE-20) in the set_term_title function in IPython.utils.terminal.py, which unsafely passes unsanitized input directly to os.system() on Windows. Attack requires: Windows OS, Python built without ctypes, set_term_title enabled, and user interaction (cd into attacker-controlled directory with shell metacharacters in its name). An attacker can inject arbitrary shell commands via directory names; for example, a directory named "&& echo pwn > pwn.txt" would create a file when the user cds into it. The function is effectively dead code in normal IPython usage because IPython depends on ctypes elsewhere, but could pose risk if used as a library. Fixed in IPython 8.10.0 and later.
Affected products
- IPython IPython <8.10.0
Timeline
- 2023-02-10: disclosed
- 2023-02-10: patched: IPython 8.10.0 and later