GMS-2022-1520: Malware in ctx
(updated )
The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of os.environ.items() when instantiating Ctx objects. The captured environment variables were sent as a base64 encoded query parameter to a heroku application running at https://anti-theft-web.herokuapp.com.
If you installed the package between May 14, 2022 and May 24, 2022, and your environment variables contain sensitive data like passwords and API keys (like AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY), we advise you to rotate your passwords and keys, then perform an audit to determine if they were exploited.
References
- github.com/advisories/GHSA-4g82-3jcr-q52w
- github.com/figlief/ctx
- isc.sans.edu/forums/diary/ctx+Python+Library+Updated+with+Extra+Features/28678/
- portswigger.net/daily-swig/malicious-python-library-ctx-removed-from-pypi-repo
- python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html
Code Behaviors & Features
Detect and mitigate GMS-2022-1520 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →