Executive brief
Ansys ansys-geometry-core is a Python library for geometric modeling and manipulation. The library contains a command injection vulnerability in code that launches external programs, allowing an attacker to execute arbitrary commands on the system where the library is used. This could lead to full system compromise depending on the privileges of the application using the library.
Technical details
The vulnerability is a classic OS command injection (CWE-78) caused by the use of shell=True in subprocess.Popen() on non-Windows systems (shell=os.name != "nt"). The vulnerable _start_program() function in product_instance.py accepts a list of arguments and launches a subprocess with shell interpretation enabled, allowing shell metacharacters in arguments to be interpreted as commands. An attacker who can control the arguments passed to this function can inject arbitrary shell commands. The vulnerability requires local code execution or the ability to influence function arguments within an application using the library. The issue was fixed in versions 0.3.3 and 0.4.12 by disabling shell=True and restricting the internal calling of this method.
Affected products
- Ansys ansys-geometry-core 0.3.0–0.3.2, 0.4.0–0.4.11
Timeline
- 2024-03-25: disclosed
- 2024-03-25: patched: Versions 0.3.3 and 0.4.12 released with fix