Path Traversal in NLTK via Percent-Encoded Sequences

Executive Summary

NLTK version 3.9.4 has a path traversal vulnerability caused by an incomplete fix for a previous issue. The vulnerability arises because the regex used to detect unsafe path sequences only checks for literal '../' but does not detect percent-encoded traversal sequences like '..%2f'. Since the decoding of these sequences happens after the validation, an attacker can bypass the check and manipulate the resource name parameter passed to functions like nltk.data.load() or nltk.data.find() to read arbitrary files accessible to the Python process.

This affects applications using NLTK for resource loading, such as NLP web applications, Jupyter notebooks, and command-line tools. Additionally, the default setting pathsec.ENFORCE=False means the file read is not blocked at the open() stage, making exploitation easier.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to read arbitrary files on the system that the Python process has access to by exploiting the path traversal flaw. This can lead to unauthorized disclosure of sensitive information, such as configuration files, credentials, or other private data stored on the system.

Because the vulnerability does not require user interaction or privileges (as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N), it can be exploited remotely and easily, increasing the risk to affected applications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to read arbitrary files accessible to the Python process by exploiting a path traversal flaw in NLTK's resource loading functions. Such unauthorized access to files could potentially lead to exposure of sensitive or personal data.

Exposure of sensitive data due to this vulnerability could impact compliance with data protection regulations such as GDPR and HIPAA, which require strict controls over access to personal and health-related information.

However, the provided information does not explicitly describe the specific compliance implications or how organizations should address this vulnerability in the context of these regulations.

Useful 0 Not Useful 0