Python Command Injection Vulnerability (Oct 2024) - Windows

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:python:python";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.114841");
  script_version("2025-02-11T05:38:07+0000");
  script_tag(name:"last_modification", value:"2025-02-11 05:38:07 +0000 (Tue, 11 Feb 2025)");
  script_tag(name:"creation_date", value:"2024-10-23 08:40:36 +0000 (Wed, 23 Oct 2024)");
  script_tag(name:"cvss_base", value:"6.8");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-02-10 18:47:16 +0000 (Mon, 10 Feb 2025)");

  script_cve_id("CVE-2024-9287");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Python Command Injection Vulnerability (Oct 2024) - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("General");
  script_dependencies("gb_python_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("python/detected", "Host/runs_windows");

  script_tag(name:"summary", value:"Python is prone to a command injection vulnerability in the venv
  module.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"A vulnerability has been found in the venv module and CLI where
  path names provided when creating a virtual environment were not quoted properly, allowing the
  virtual environment creator to inject commands into virtual environment 'activation' scripts (ie
  'source venv/bin/activate'). This means that attacker-controlled virtual environments are able to
  run commands when the virtual environment is activated. Virtual environments which are not created
  by an attacker or which aren't activated before being used (ie './venv/bin/python') are not
  affected.");

  script_tag(name:"affected", value:"Python versions prior to 3.9.21, 3.10.x prior to 3.10.16,
  3.11.x prior to 3.11.11, 3.12.x prior to 3.12.8 and 3.13.x prior to 3.13.1.");

  script_tag(name:"solution", value:"Update to version 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1
  or later.");

  script_xref(name:"URL", value:"https://mail.python.org/archives/list/[email protected]/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/");
  script_xref(name:"URL", value:"https://github.com/python/cpython/issues/124651");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/124712");
  script_xref(name:"URL", value:"https://docs.python.org/release/3.13.1/whatsnew/changelog.html#changelog");
  script_xref(name:"URL", value:"https://docs.python.org/release/3.12.8/whatsnew/changelog.html#changelog");
  script_xref(name:"URL", value:"https://docs.python.org/release/3.11.11/whatsnew/changelog.html#changelog");
  script_xref(name:"URL", value:"https://docs.python.org/release/3.10.16/whatsnew/changelog.html#python-3-10-16-final");
  script_xref(name:"URL", value:"https://docs.python.org/release/3.9.21/whatsnew/changelog.html#python-3-9-21-final");
  script_xref(name:"URL", value:"https://osv.dev/vulnerability/PSF-2024-12");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE,
                                          version_regex: "^[0-9]+\.[0-9]+\.[0-9]+"))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "3.9.21")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.9.21", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.10", test_version_up: "3.10.16")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.10.16", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.11", test_version_up: "3.11.11")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.11.11", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.12", test_version_up: "3.12.8")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.12.8", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.13", test_version_up: "3.13.1")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.13.1", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);