Summary
h5io's HDF5 reader can execute attacker-controlled code when it processes a crafted HDF5 file. This may happen through evaluated timezone data, imports named in object nodes, or pickled data deserialized by pandas.
h5io's HDF5 reader can execute attacker-controlled code when it processes a crafted HDF5 file. This may happen through evaluated timezone data, imports named in object nodes, or pickled data deserialized by pandas.
Affected context
The issue affects h5io versions before 0.2.6 when applications use read_hdf5() to process HDF5 files an attacker can influence. The risky behavior occurs while interpreting particular file nodes, including timezone, class or custom-object, and pandas dataframe or series nodes.
The issue affects h5io versions before 0.2.6 when applications use read_hdf5() to process HDF5 files an attacker can influence. The risky behavior occurs while interpreting particular file nodes, including timezone, class or custom-object, and pandas dataframe or series nodes.
Exploit preconditions
- Attack surface: An application or workflow reads HDF5 files with h5io.
- Required access: The attacker must be able to supply or modify a file that the reader processes; the description does not establish a particular authentication requirement.
- Trigger point: The crafted file is processed by
read_hdf5(). - Why exploitation is possible: The reader evaluates timezone content, imports classes named in nodes, or invokes pandas deserialization for pickled objects.
- Attack surface: An application or workflow reads HDF5 files with h5io.
- Required access: The attacker must be able to supply or modify a file that the reader processes; the description does not establish a particular authentication requirement.
- Trigger point: The crafted file is processed by
read_hdf5(). - Why exploitation is possible: The reader evaluates timezone content, imports classes named in nodes, or invokes pandas deserialization for pickled objects.
Why this happens
The reader treats file contents as executable or trusted instructions rather than data. Passing attacker-controlled content to eval() with builtins reachable maps to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code. Importing attacker-selected modules and deserializing pickle data also expose unsafe interpretation paths, corresponding to CWE-502: Deserialization of Untrusted Data.
The reader treats file contents as executable or trusted instructions rather than data. Passing attacker-controlled content to eval() with builtins reachable maps to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code. Importing attacker-selected modules and deserializing pickle data also expose unsafe interpretation paths, corresponding to CWE-502: Deserialization of Untrusted Data.
Potential impact
- Arbitrary code may execute with the privileges of the process reading the file.
- An attacker could access or alter data available to that process.
- The application or its runtime environment could be compromised.
- The process could be used to affect connected services or systems, depending on its permissions and network access.
- Arbitrary code may execute with the privileges of the process reading the file.
- An attacker could access or alter data available to that process.
- The application or its runtime environment could be compromised.
- The process could be used to affect connected services or systems, depending on its permissions and network access.
General mitigation guidance
Mitigation generally focuses on treating HDF5 files as untrusted input and removing execution-capable parsing paths.
- Avoid evaluating file-derived strings; use explicit, non-executable parsing for values such as timezones.
- Resolve object types through a narrow, trusted allowlist rather than importing names supplied by files.
- Avoid pickle-based deserialization for untrusted data; prefer formats and parsers that represent data without constructing arbitrary objects.
- Validate file structure and expected types before application logic uses parsed values.
- Limit the reader process's filesystem, network, and operating-system privileges to reduce potential impact.
Mitigation generally focuses on treating HDF5 files as untrusted input and removing execution-capable parsing paths.
- Avoid evaluating file-derived strings; use explicit, non-executable parsing for values such as timezones.
- Resolve object types through a narrow, trusted allowlist rather than importing names supplied by files.
- Avoid pickle-based deserialization for untrusted data; prefer formats and parsers that represent data without constructing arbitrary objects.
- Validate file structure and expected types before application logic uses parsed values.
- Limit the reader process's filesystem, network, and operating-system privileges to reduce potential impact.
How teams detect issues like this
- Use static analysis to identify
eval()and pickle-capable deserialization applied to file-derived values. - Review HDF5 parsing code for dynamic imports or class resolution driven by node contents.
- Add code-review checks for parsing paths that execute, import, or construct objects from untrusted files.
- Enforce policies that prohibit unsafe evaluation and restrict deserialization of untrusted data.
- Test file-ingestion boundaries with security-focused review and automated analysis tools.
- Use static analysis to identify
eval()and pickle-capable deserialization applied to file-derived values. - Review HDF5 parsing code for dynamic imports or class resolution driven by node contents.
- Add code-review checks for parsing paths that execute, import, or construct objects from untrusted files.
- Enforce policies that prohibit unsafe evaluation and restrict deserialization of untrusted data.
- Test file-ingestion boundaries with security-focused review and automated analysis tools.
