Patchfirst
Patchfirst
CVE-2019-16784 Public exploit High · 7.0 EPSS 0.7%

Local Privilege Escalation present only on the Windows version of PyInstaller

PyInstaller · PyInstaller

Official description · CVE.org

In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user (at least more than the current one) which have his "TempPath" resolving to a world writable directory. This is the case for example if the software is launched as a service or as a scheduled task using a system account (TempPath will be C:\Windows\Temp). In order to be exploitable the software has to be (re)started after the attacker launch the exploit program, so for a service launched at startup, a service restart is needed (e.g. after a crash or an upgrade).

Breakdown
20.5 / 100
Exploited
Not confirmed
Reports
0
Tactics
3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. What they do

  2. What can follow

Public exploit code (PoC-in-GitHub) appeared 8 days after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+8 days

techniques

3 , grouped by in kill-chain order 3

Initial AccessTA0001

Exploit Public-Facing Application T1190
MITRE CTID mapping of the CVE · primary impact

ExecutionTA0002

Python T1059.006
MITRE CTID mapping of the CVE · follow-on activity

Privilege EscalationTA0004

Exploitation for Privilege Escalation T1068
MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 193 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-16784 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Exploitation for Privilege EscalationT106831 general rules
All 31 on SigmaHQ ↗
PythonT1059.00613 general rules
All 13 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: PyInstaller.

PyPIPyInstallerGHSA-7fcj-pq9j-wh2rPYSEC-2020-175

Upgrade to 3.6 or later

pippip install "PyInstaller>=3.6"

The first fix for CVE-2019-16784. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
All versions before 3.63.6

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

1 link, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/pyinstaller/pyinstaller/security/advisories/GHSA-7fcj-pq9j-wh2r
↑ ↓ chooseEnter openEsc close