Security firm Checkmarx found that one in three PyPI software packages contains a flaw that can lead to automatic installation of malicious code.
Many Python Package Index (PyPi) software packages are vulnerable to a feature that could allow an attacker to automatically execute malicious code before installation, while developers simply download a package.
That’s according to researchers at cybersecurity firm Checkmarx, who said that the autorun of code is triggered by downloading about a third of the packages in the software repository.
“This feature is alarming due to the fact that a lot of malicious packages we find in the wild use this code execution feature during installation to achieve higher infection rates,” Checkmarx said in a post published Friday (26 of August).
Checkmarx, which also recently found a flaw in Amazon’s Ring camera system, is now warning Python developers that downloading packages could increase the risk of a supply chain attack.
What is the problem?
When a developer installs a Python package, PIP, the Python package manager, attempts to collect and process the package’s metadata, such as its version and any dependencies it needs to function properly.
This process happens automatically in the background when PIP runs the main setup.py script that comes as part of the package structure. The purpose of this is to provide a data structure for the package manager to understand how to handle the package.
However, according to Checkmarx, the setup.py file can contain whatever code the package developer wants, which means that an attacker who understands this process can plant malicious code that will then be automatically executed during the download.
“In fact, a large part of the malicious packages we are detecting contain malicious code in the ‘setup.py’ file,” Checkmarx added.
What is concerning about this flaw is the fact that it can affect developers even if they choose not to install the file, but simply download it to view its code or perform a security check.
Checkmarx researchers found that simply downloading the package will execute the ‘setup.py’ file and any potentially malicious code it contains, which they described as “not a bug but a feature in the design of PIP”.
This is not the first time people have raised concerns about it. Checkmarx noted that the issue was previously highlighted in 2014, but was never addressed.
how to fix this
Checkmarx said there are workarounds that can help developers avoid automated code execution. One action is to check the contents of the package file before downloading it for a .whl file.
PyPi has introduced a new type of wheel file (.whl) that removes the need to run setup.py. However, it still allows contributors to choose their preferred format for compatibility, with some choosing the more vulnerable tar.gz format, which includes the setup.py file.
“If there is a .whl file, the user can be sure that they will receive the .whl file and no code will be executed on their machine. If only one tar.gz is present, a user can use a secure download method, such as working directly with the ‘simple’ PyPi API,” said Checkmarx.
Tzachi Zorenshtain, head of supply chain security at Checkmarx, told SC Media that when developers install a software package from repositories like PyPi, most are aware of the risk of installing associated malicious code, and the vulnerability is not known. can be fixed easily.
“If we magically changed all formats and everything was sent and archived again in the new format, it would be easy to remove this behavior. We understand that this behavior will probably be with us for a while, so at least [building] awareness is what was important to us.”
10 things you need to know delivered straight to your inbox every day of the week. Sign up for the Daily summarySilicon Republic’s roundup of essential science and technology news.
