Executive brief
Pillow, a widely-used Python image processing library, contains an arbitrary code execution vulnerability in its ImageMath.eval function. An attacker can exploit an unsafe environment parameter to execute arbitrary Python code, potentially compromising systems that process untrusted image data or expressions. This could lead to complete system takeover, data theft, or malware deployment.
Technical details
The PIL.ImageMath.eval function is vulnerable to arbitrary code execution due to improper sanitization of the environment parameter. Unlike the earlier CVE-2022-22817 (which addressed the expression parameter), this vulnerability allows an attacker to inject malicious Python code through the environment dictionary passed to eval(). The attack does not require user interaction or authentication and is reachable over the network if the application exposes ImageMath.eval functionality. An attacker can achieve arbitrary code execution with the privileges of the Python process. The vulnerability was patched in Pillow 10.2.0 by restricting the environment dictionary to disallow double-underscore prefixes and builtins access.
Affected products
- Python Pillow Pillow through 10.1.0
Timeline
- 2024-01-19: disclosed
- 2024-01-22: patched: Fixed in Pillow 10.2.0