PyPi: Impacket

CVE-2021-31800

Safety vulnerability ID: 48475

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at May 05, 2021 Updated at Sep 16, 2024
Scan your Python projects for vulnerabilities →

Advisory

Impacket 0.9.23 fixes Path Traversal vulnerability in 'smbserver.py'. See CVE-2021-31800.
https://github.com/SecureAuthCorp/impacket/commit/99bd29e3995c254e2d6f6c2e3454e4271665955a

Affected package

impacket

Latest version: 0.12.0

Network protocols Constructors and Dissectors

Affected versions

Fixed versions

Vulnerability changelog

1. Library improvements
* Support connect timeout with SMBTransport (vruello)
* Speeding up DcSync (mohemiv)
* Fixed Python3 issue when serving SOCKS5 requests (agsolino)
* Moved docker container to Python 3.8 (mgallo)
* Added basic GitHub Actions workflow (mgallo)
* Fixed Path Traversal vulnerabilities in `smbserver.py` - CVE-2021-31800 (omriinbar AppSec Researcher at CheckMarx)
* Fixed POST request processing in `httprelayserver.py` (Rcarnus)
* Added cat command to `smbclient.py` (mxrch)
* Added new features to the LDAP Interactive Shell to facilitate AD exploitation (AdamCrosser)
* Python 3.9 support (meeuw and cclauss)

2. Examples improvements
* [addcomputer.py](examples/addcomputer.py):
* Enable the machine account created via SAMR (0xdeaddood)
* [getST.py](examples/getST.py):
* Added exploit for CVE-2020-17049 - Kerberos Bronze Bit attack (jakekarnes42)
* Compute NTHash and AESKey for the Bronze Bit attack automatically (snovvcrash)
* [ntlmrelayx.py](examples/ntlmrelayx.py):
* Fixed target parsing error (0xdeaddood)
* [wmipersist.py](examples/wmipersist.py):
* Fixed `filterBinding` error (franferrax)
* Added PowerShell option for semi-interactive shells in `dcomexec.py`, `smbexec.py`
and `wmiexec.py` (snovvcrash)
* Added new parameter to select `COMVERSION` in `dcomexec.py`, `wmiexec.py`,
`wmipersist.py` and `wmiquery.py` (zexusx26)

3. New examples
* [Get-GPPPassword.py](examples/Get-GPPPassword.py): This example extracts and decrypts
Group Policy Preferences passwords using streams for treating files instead of mounting
shares. Additionally, it can parse GPP XML files offline (ShutdownRepo and p0dalirius)
* [smbpasswd.py](examples/smbpasswd.py): This script is an alternative to `smbpasswd` tool and
intended to be used for changing expired passwords remotely over SMB (MSRPC-SAMR) (snovvcrash)

As always, thanks a lot to all these contributors that make this library better every day (since last version):

mpgn vruello mohemiv jagotu jakekarnes42 snovvcrash zexusx26 omriinbar Rcarnus nuschpl mxrch ShutdownRepo p0dalirius AdamCrosser franferrax meeuw and cclauss

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

CRITICAL 9.8

CVSS v3 Details

CRITICAL 9.8
Attack Vector (AV)
NETWORK
Attack Complexity (AC)
LOW
Privileges Required (PR)
NONE
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
HIGH
Integrity Impact (I)
HIGH
Availability Availability (A)
HIGH

CVSS v2 Details

HIGH 7.5
Access Vector (AV)
NETWORK
Access Complexity (AC)
LOW
Authentication (Au)
NONE
Confidentiality Impact (C)
PARTIAL
Integrity Impact (I)
PARTIAL
Availability Impact (A)
PARTIAL