CVE-2020-15523: Python DLL Hijacking Vulnerability

CVE-2020-15523 Overview

CVE-2020-15523 is a DLL Injection vulnerability affecting Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows systems. The vulnerability occurs when CPython is embedded in a native application, where a Trojan horse python3.dll might be loaded due to an invalid search path used by python3X.dll after Py_SetPath has been called. This is classified as CWE-427 (Uncontrolled Search Path Element).

Critical Impact
Attackers can achieve arbitrary code execution by placing a malicious python3.dll in a location that will be searched before the legitimate DLL, enabling full system compromise in environments using embedded Python.

Affected Products

Python 3.6 through 3.6.10 on Windows
Python 3.7 through 3.7.8 on Windows
Python 3.8 through 3.8.4rc1 on Windows
Python 3.9 through 3.9.0b4 (including alpha and beta releases) on Windows
NetApp SnapCenter

Discovery Timeline

2020-07-04 - CVE-2020-15523 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-15523

Vulnerability Analysis

This vulnerability is rooted in how the Windows DLL search order is handled when Python is embedded in native applications. When a developer embeds CPython in their Windows application and uses the Py_SetPath API to configure Python paths, the version-specific DLL (python3X.dll, where X represents the minor version) attempts to load the base python3.dll. However, due to improper search path configuration following the Py_SetPath call, the loading mechanism may search for python3.dll in insecure locations before finding the legitimate system library.

This creates a classic DLL hijacking scenario where an attacker can place a malicious DLL named python3.dll in a directory that appears earlier in the search path—such as the application's working directory or a user-writable location. When the embedded Python runtime initializes, it loads and executes the attacker-controlled DLL with the privileges of the host application.

It's important to note that this vulnerability specifically affects embedded Python scenarios and cannot occur when using python.exe from a standard Python installation on Windows.

Root Cause

The root cause is an uncontrolled search path element (CWE-427) in the DLL loading logic. When Py_SetPath is invoked to customize the Python path in embedded scenarios, the subsequent loading of python3.dll by python3X.dll does not properly constrain the DLL search path. This oversight allows the Windows loader to search untrusted directories for the required DLL before checking secure system locations.

Attack Vector

The attack requires local access and typically involves the following steps:

An attacker identifies an application that embeds CPython and uses Py_SetPath to configure paths
The attacker places a malicious python3.dll in a location searched by the Windows DLL loader (such as the application directory or current working directory)
When the victim launches the application, the embedded Python runtime attempts to load python3.dll
Due to the insecure search path, the malicious DLL is loaded and executed with the application's privileges
The attacker achieves arbitrary code execution in the context of the compromised application

This attack requires user interaction (launching the vulnerable application) and local file system access to plant the malicious DLL.

Detection Methods for CVE-2020-15523

Indicators of Compromise

Presence of unexpected python3.dll files in application directories or user-writable paths
DLL load events showing python3.dll being loaded from non-standard Python installation directories
Applications embedding Python exhibiting unexpected behavior or network connections after startup
Process creation events spawned by embedded Python applications that are inconsistent with normal operation

Detection Strategies

Monitor for python3.dll file creation events in directories outside of standard Python installation paths
Implement application whitelisting to detect unauthorized DLL loading
Use endpoint detection and response (EDR) solutions to monitor DLL load patterns for applications known to embed Python
Audit and alert on modifications to directories containing embedded Python applications

Monitoring Recommendations

Configure file integrity monitoring on directories containing applications that embed CPython
Enable detailed Windows DLL loading audit logs (Audit Object Access for file system events)
Deploy behavioral analysis to detect anomalous execution patterns following Python runtime initialization
Review and inventory all applications in your environment that embed Python to assess exposure

How to Mitigate CVE-2020-15523

Immediate Actions Required

Upgrade affected Python installations to patched versions: 3.6.11+, 3.7.9+, 3.8.5+, or 3.9.0rc1+
Audit all applications in your environment that embed CPython to identify those requiring updates
Remove write permissions from directories containing embedded Python applications where possible
Implement application control policies to prevent unauthorized DLL loading

Patch Information

The Python development team has addressed this vulnerability in subsequent releases. The fix is tracked in GitHub Pull Request #21297 and documented in Python Issue Tracker Entry. Organizations using NetApp SnapCenter should consult the NetApp Security Advisory NTAP-20210312-0004 for specific remediation guidance.

Upgrade to the following patched versions:

Python 3.6.11 or later for the 3.6 branch
Python 3.7.9 or later for the 3.7 branch
Python 3.8.5 or later for the 3.8 branch
Python 3.9.0rc1 or later for the 3.9 branch

Workarounds

Restrict write access to directories where embedded Python applications reside
Configure the SetDllDirectory API to remove the current directory from the DLL search path before initializing embedded Python
Deploy applications embedding Python in protected directories that users cannot modify
Consider using fully qualified paths when loading Python DLLs in embedded scenarios

bash

# Verify Python version and check for vulnerability
python --version

# Check if running in embedded context (for developers)
# Ensure Py_SetPath usage is followed by secure DLL loading practices

# Restrict directory permissions (example for application directory)
icacls "C:\Path\To\EmbeddedApp" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F" /grant:r "Users:(OI)(CI)RX"