filelock SoftFileLock Symlink Writable Path Check Vulnerability

Executive Summary

This vulnerability affects the filelock Python library versions 3.32.6 to 4.2.0. It involves a symlink swap attack where a local attacker can replace a lock file with a symlink during a writability check. This allows the attacker to infer whether a target path exists and is writable by observing the lock acquisition result, leaking one bit of information per attempt.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses filelock versions between 3.32.6 and 4.2.0. Run: pip show filelock to verify the installed version. If the version falls within this range, the system is vulnerable. Additionally, monitor for unusual symlink behavior in lock file directories, especially in world-writable or group-writable sticky directories like /tmp.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this to determine if specific files or directories exist and are writable on your system. This could aid in further attacks like unauthorized access, data leakage, or privilege escalation, depending on the system configuration and sensitive files present.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later immediately using pip install --upgrade filelock. Ensure your system enforces symlink protections by setting fs.protected_symlinks=1 in /etc/sysctl.conf and running sysctl -p. Avoid using world-writable or group-writable sticky directories for lock files if possible.

Useful 0 Not Useful 0