CVE-2022-30877: Keep Python Package RCE Vulnerability

CVE-2022-30877 Overview

CVE-2022-30877 is a critical supply chain vulnerability affecting the keep Python package distributed via PyPI. A malicious third party inserted a code-execution backdoor into the package, allowing attackers to execute arbitrary code on systems that installed the compromised version. This type of supply chain attack represents one of the most dangerous threat vectors in modern software development, as developers often implicitly trust packages from popular repositories like PyPI.

Critical Impact

Systems that installed the compromised version of the keep package may have been exposed to arbitrary code execution, potentially leading to complete system compromise, data exfiltration, and lateral movement within networks.

Affected Products

• keep_project keep (versions prior to 1.2)
• Python environments with the compromised keep package installed from PyPI
• Any applications or systems that imported the backdoored keep module

Discovery Timeline

• 2022-06-08 - CVE-2022-30877 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-30877

Vulnerability Analysis

This vulnerability represents a software supply chain attack where a malicious actor gained the ability to inject a code-execution backdoor into the keep Python package distributed through PyPI. Supply chain attacks targeting package repositories are particularly insidious because they exploit the trust relationship between developers and package ecosystems.

When a developer installs a Python package using pip install keep, the package manager retrieves the code from PyPI and executes any setup scripts as part of the installation process. In this case, the compromised package contained malicious code that would execute during or after installation, providing the attacker with code execution capabilities on the victim's system.

The attack leverages the fact that Python packages can execute arbitrary code during installation via setup.py scripts, or at runtime when the package is imported. This allows attackers to establish persistence, exfiltrate sensitive data, or use the compromised system as a pivot point for further attacks.

Root Cause

The root cause of this vulnerability is a supply chain compromise where a third party successfully inserted malicious code into the keep package distributed on PyPI. This could have occurred through various means including:

• Compromised maintainer credentials allowing unauthorized package uploads
• Typosquatting or dependency confusion attacks
• Exploitation of the package repository's upload mechanisms

The vulnerability highlights the inherent risks in trusting third-party code repositories and the need for robust package verification mechanisms.

Attack Vector

The attack vector is network-based, as victims are compromised when they download and install the malicious package from PyPI over the network. The attack requires no user interaction beyond the standard package installation process.

The backdoor could be triggered in multiple ways depending on its implementation:

• During installation: Malicious code in setup.py executes with the privileges of the user running pip install
• At import time: Code executes when an application imports the keep module
• During normal usage: Backdoor functionality hidden within legitimate-looking code paths

The attacker would receive remote code execution capabilities on any system that installed the compromised package version, allowing them to run arbitrary commands, access sensitive files, establish reverse shells, or deploy additional malware.

Detection Methods for CVE-2022-30877

Indicators of Compromise

• Presence of keep package versions prior to 1.2 in Python environments
• Unexpected network connections originating from Python processes
• Suspicious Python package installations in pip logs or virtual environments
• Anomalous process spawning from Python interpreter processes

Detection Strategies

• Audit all Python environments for installed versions of the keep package using pip show keep or pip freeze | grep keep
• Review pip installation logs for evidence of compromised package installation
• Monitor for suspicious outbound network connections from Python processes
• Implement Software Composition Analysis (SCA) tools to track package versions across development and production environments

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions like SentinelOne to monitor for malicious process behavior and code execution
• Implement network monitoring to detect command-and-control communications
• Configure package repository proxies that scan for known malicious packages
• Enable logging for all package installation activities in CI/CD pipelines

How to Mitigate CVE-2022-30877

Immediate Actions Required

• Immediately upgrade the keep package to version 1.2 or later using pip install --upgrade keep
• Audit all systems, containers, and virtual environments for compromised package versions
• Investigate any systems with the compromised package for signs of post-exploitation activity
• Reset credentials and secrets that may have been accessible on compromised systems

Patch Information

The clean version of the keep package is 1.2, which has the backdoor removed. Organizations should upgrade immediately by running:

pip install keep==1.2

For additional information, refer to the PyPI Project for Keep and the GitHub Issue #85 Discussion which contains community discussion about this security incident.

Workarounds

• Pin package versions explicitly in requirements.txt files to prevent automatic installation of potentially compromised versions
• Use virtual environments to isolate Python dependencies and limit blast radius
• Implement package hash verification using pip --require-hashes to ensure package integrity
• Consider using a private PyPI mirror or repository manager that provides additional security scanning

# Configuration example
# Upgrade keep package to safe version
pip install --upgrade keep==1.2

# Verify installed version
pip show keep | grep Version

# Check for package in all virtual environments
find / -name "site-packages" -exec ls -la {}/keep 2>/dev/null \;

# Pin safe version in requirements.txt
echo "keep==1.2" >> requirements.txt