CVE-2022-21668: Pypa Pipenv RCE Vulnerability

CVE-2022-21668 Overview

CVE-2022-21668 is a critical Input Validation vulnerability in pipenv, a popular Python development workflow tool. The flaw exists in pipenv's parsing of requirements files, allowing an attacker to embed a specially crafted string inside a comment anywhere within a requirements.txt file. When victims use pipenv to install the compromised requirements file, dependencies are downloaded from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, attackers can trigger arbitrary remote code execution (RCE) on victims' systems.

Critical Impact

Attackers can achieve remote code execution by hiding a malicious --index-url option within a requirements file comment, causing pipenv to download and execute malicious packages during installation.

Affected Products

• pypa pipenv versions 2018.10.9 to prior to 2022.1.8
• Fedora 34, 35, and 36 (via packaged pipenv)
• Any system using vulnerable pipenv versions to install requirements files

Discovery Timeline

• 2022-01-10 - CVE CVE-2022-21668 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21668

Vulnerability Analysis

This vulnerability stems from improper input validation in pipenv's requirements file parser. The parser fails to properly sanitize or validate content within comments in requirements.txt files. An attacker can exploit this weakness by inserting a malicious --index-url directive hidden within a comment block. When pipenv processes the requirements file, it incorrectly interprets this hidden directive as a legitimate configuration option.

The attack chain operates as follows: when pip installs packages from a source distribution, any code present in the setup.py file is executed during the installation process. By redirecting package downloads to an attacker-controlled index server, the attacker can serve malicious packages containing arbitrary code in their setup.py files. This code executes with the privileges of the user running the installation, potentially leading to complete system compromise.

Root Cause

The root cause is insufficient validation and sanitization of requirements file content, specifically failing to properly handle or escape pip-style options embedded within comments. The parser does not adequately distinguish between legitimate configuration directives and malicious content hidden within comment sections, classified under CWE-20 (Improper Input Validation) and CWE-190 (Integer Overflow or Wraparound).

Attack Vector

This is a local attack vector requiring user interaction. The attacker must convince a victim to use pipenv to install a maliciously crafted requirements.txt file. Attack scenarios include:

1. Contributing a poisoned requirements.txt to an open-source project
2. Sharing a malicious requirements file via documentation or tutorials
3. Compromising a project repository to inject the malicious directive
4. Supply chain attacks where the attacker modifies shared requirements files

The security patch introduced a new get_host_and_port function to properly parse and validate URLs, ensuring malicious index URLs embedded in comments cannot hijack the package installation process:

def get_host_and_port(url):
    """Get the host, or the host:port pair if port is explicitly included, for the given URL.

    Examples:
    >>> get_host_and_port('example.com')
    'example.com'
    >>> get_host_and_port('example.com:443')
    'example.com:443'
    >>> get_host_and_port('http://example.com')
    'example.com'
    >>> get_host_and_port('https://example.com/')
    'example.com'
    >>> get_host_and_port('https://example.com:8081')
    'example.com:8081'
    >>> get_host_and_port('ssh://example.com')
    'example.com'

    :param url: the URL string to parse
    :return: a string with the host:port pair if the URL includes port number explicitly; otherwise, returns host only
    """
    url = urllib3_util.parse_url(url)
    return '{}:{}'.format(url.host, url.port) if url.port else url.host

Source: GitHub Commit 439782a8

Detection Methods for CVE-2022-21668

Indicators of Compromise

• Unusual network connections to unknown package index servers during pip/pipenv installations
• Requirements files containing --index-url, --extra-index-url, or -i flags within comment sections
• Unexpected execution of setup.py scripts from unfamiliar packages
• Network traffic to non-standard PyPI mirrors or unknown domain names during dependency installation

Detection Strategies

• Scan requirements files for embedded pip options (e.g., --index-url, -i, --extra-index-url) appearing anywhere in the file, including comments
• Implement code review processes that specifically check requirements files for suspicious content
• Use static analysis tools to detect potentially malicious directives in Python dependency files
• Monitor DNS queries for unusual package index domains during CI/CD pipeline execution

Monitoring Recommendations

• Enable network monitoring to detect connections to non-standard package repositories during build processes
• Implement alerts for any pip installation that uses a non-PyPI index server
• Log and audit all requirements file changes in version control systems
• Deploy endpoint detection to monitor for suspicious process execution chains during Python package installations

How to Mitigate CVE-2022-21668

Immediate Actions Required

• Upgrade pipenv to version 2022.1.8 or later immediately
• Audit all existing requirements.txt files in your projects for suspicious content within comments
• Review recent changes to requirements files in version control history
• Temporarily use pip directly with explicit --index-url https://pypi.org/simple/ until pipenv is upgraded

Patch Information

The vulnerability is patched in pipenv version 2022.1.8. The fix introduces proper URL parsing and validation through the new get_host_and_port function in pipenv/utils.py. Users should upgrade using:

pip install --upgrade pipenv>=2022.1.8

For additional details, refer to the GitHub Security Advisory GHSA-qc9x-gjcv-465w and the official release notes for v2022.1.8. Fedora users should apply the appropriate package updates for their distribution version.

Workarounds

• Manually inspect all requirements.txt files before running pipenv install, specifically searching for any pip options within comments
• Use pip install -r requirements.txt --index-url https://pypi.org/simple/ directly to explicitly set a trusted index
• Implement pre-commit hooks that scan requirements files for embedded options before allowing commits
• Consider using pip-compile or poetry as alternative dependency management tools until upgrade is complete

# Verify current pipenv version
pipenv --version

# Upgrade pipenv to patched version
pip install --upgrade pipenv>=2022.1.8

# Scan requirements files for suspicious content
grep -E '(--index-url|--extra-index-url|-i\s)' requirements*.txt

# Install with explicit trusted index
pip install -r requirements.txt --index-url https://pypi.org/simple/ --trusted-host pypi.org