Arbitrary File Read in NLTK BllipParser

Executive Summary

This vulnerability is an arbitrary file read issue in NLTK versions 3.10.0 through 3.10.3 affecting the BllipParser component. Attackers can manipulate model path inputs like parser_model or reranker_features to make the bllipparser C extension read sensitive files outside NLTK's intended data directories. The flaw occurs due to improper path validation, allowing access to arbitrary files or blocking on special files such as FIFOs and devices.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is 3.10.0 to 3.10.3, the system is vulnerable. Inspect applications using BllipParser for untrusted model path inputs like parser_model, reranker_features, or reranker_weights.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information disclosure if attackers read sensitive files on your system. It may also cause performance issues or system hangs if the path points to non-regular files like FIFOs or devices. Attackers could exploit this to access restricted data or disrupt services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to sensitive personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach via this flaw may result in violations and associated penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.4 or later immediately. Review and sanitize all model path inputs in BllipParser to ensure they only reference approved NLTK data directories.

Useful 0 Not Useful 0