Python Untrusted Search Path Vulnerability (Feb 2025) - Windows

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:python:python";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.171228");
  script_version("2025-10-10T05:39:02+0000");
  script_tag(name:"last_modification", value:"2025-10-10 05:39:02 +0000 (Fri, 10 Oct 2025)");
  script_tag(name:"creation_date", value:"2025-02-18 08:06:42 +0000 (Tue, 18 Feb 2025)");
  script_tag(name:"cvss_base", value:"5.5");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:N/I:P/A:P");

  script_cve_id("CVE-2024-3220");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Python Untrusted Search Path Vulnerability (Feb 2025) - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("gb_python_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("python/detected", "Host/runs_windows");

  script_tag(name:"summary", value:"Python is prone to an untrusted search path vulnerability
  in the mimetypes standard library.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"There is a defect in the CPython standard library module
  'mimetypes' where on Windows the default list of known file locations are writable meaning other
  users can create invalid files to cause MemoryError to be raised on Python runtime startup or
  have file extensions be interpreted as the incorrect file type.

  This defect is caused by the default locations of Linux and macOS platforms (such as
  '/etc/mime.types') also being used on Windows, where they are user-writable locations
  ('C:\etc\mime.types').");

  script_tag(name:"affected", value:"Python versions prior to 3.14.0.");

  script_tag(name:"solution", value:"Update to version 3.14.0 or later.");

  script_xref(name:"URL", value:"https://mail.python.org/archives/list/[email protected]/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/");
  script_xref(name:"URL", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2345794");
  script_xref(name:"URL", value:"https://osv.dev/vulnerability/PSF-2025-2");
  # nb: The PSF seems to publish the affected / fixed versions in the "Product Status" part of
  # these since some time. So even it is a more generic link this should / will be always included.
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2024-3220");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE,
                                          version_regex: "^[0-9]+\.[0-9]+\.[0-9]+"))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "3.14.0")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.14.0", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);