CVE-2026-9323: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-9323 is a cryptographically weak PRNG vulnerability in the urwid web display backend (urwid/display/web.py) that allows attackers to predict or enumerate web session identifiers, enabling session hijacking, keystroke injection, and arbitrary OS command execution. It affects urwid versions up to and including commit 24acd12 (the vulnerable commit). The vulnerability was discovered by security researcher Katriel Moses during an audit disclosed on April 27, 2026, and published on July 18, 2026. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). In Screen.start(), the session identifier (urwid_id) was generated by concatenating two random.randrange(10**9) calls using Python's Mersenne Twister PRNG — a non-cryptographically secure algorithm. Each call consumes approximately 30 bits of PRNG state; since the Mersenne Twister has ~19,937 bits of internal state, an attacker observing approximately 334 session IDs (e.g., via the X-Urwid-ID HTTP response header) can fully reconstruct the PRNG state and predict all past and future session IDs (Path B). Additionally, the same identifier is used as the filename of a FIFO in the world-listable /tmp directory (e.g., /tmp/urwid375487765176907690.in), allowing any local user to enumerate active session tokens by simply listing /tmp (Path A). A prior Bandit S311 security warning on this code was suppressed with # noqa: S311 rather than remediated (GitHub Advisory, urwid Issue #1127).

With a valid session ID obtained via either attack path, an attacker can read the victim's terminal screen through the polling endpoint, inject arbitrary keystrokes into the victim's session (yielding OS-level code execution with the session owner's privileges if the session runs a shell), inject exit sequences, or flood the FIFO to crash or terminate the session. The confidentiality, integrity, and availability impacts are all rated High, as an attacker can fully compromise the affected session and any data or systems accessible to the session owner (GitHub Advisory, VulnCheck).

1. Reconnaissance (Path B — Remote): Identify a publicly accessible urwid web display backend instance. Send HTTP requests to the application and collect X-Urwid-ID response headers to harvest session identifiers.
2. PRNG State Reconstruction: Collect approximately 334 session IDs. Use a Mersenne Twister state reconstruction tool (e.g., based on the randcrack library) to recover the full internal PRNG state from the observed random.randrange(10**9) outputs.
3. Session ID Prediction: With the reconstructed PRNG state, compute past and future session IDs to identify active sessions belonging to target users.
4. Reconnaissance (Path A — Local): Alternatively, as a local user on the host, run ls /tmp/urwid*.in to directly enumerate active session FIFO filenames, which are identical to the session tokens.
5. Session Hijacking: Use the obtained session ID to authenticate to the urwid web polling endpoint and read the victim's terminal screen contents.
6. Keystroke Injection / Code Execution: Write crafted keystrokes (e.g., shell commands) to the victim's session FIFO (/tmp/urwid<id>.in), causing arbitrary OS commands to execute with the session owner's privileges if the session is running a shell.
7. Session Disruption (Optional): Inject exit sequences or flood the FIFO to crash or terminate the victim's session (GitHub Advisory, urwid Issue #1127).

• Network: Unusual or repeated HTTP requests to the urwid web polling endpoint from unexpected source IPs; HTTP responses containing X-Urwid-ID headers being harvested in high volume from a single client.
• File System: Presence of FIFO files in /tmp matching the pattern /tmp/urwid*.in or /tmp/urwid*.out; unexpected access or modification timestamps on these FIFO files by processes other than the owning urwid session.
• Logs: Web server access logs showing a large number of requests to the urwid polling endpoint from a single IP, consistent with session ID harvesting; unexpected process execution (e.g., shell commands) initiated from within a urwid session.
• Process: Unexpected child processes spawned by the urwid application process (e.g., /bin/bash, curl, wget) that were not initiated by the legitimate session user.

The fix was merged in pull request #1128 (April 28, 2026) and further hardened in commit 24acd12, which replaces the insecure random.randrange() calls with secrets.token_urlsafe(16) — a cryptographically secure random identifier — and changes the FIFO file permissions to 0o600 to restrict access. Users should update urwid to a version incorporating commit 24acd12 or later. As a workaround prior to patching, restrict access to the /tmp directory, limit network exposure of the urwid web backend, and monitor for unexpected FIFO access. Additionally, consider implementing session timeouts and rate limiting on the polling endpoint (urwid PR #1128, Fix Commit).

The vulnerability was responsibly disclosed by researcher Katriel Moses on April 27, 2026, via a public GitHub issue after being unable to reach maintainers through the private security advisory channel. The urwid maintainer penguinolog responded quickly, merging a fix within one day (April 28, 2026), and the fix was subsequently hardened further. The issue highlighted a notable lapse: a Bandit static analysis warning (S311) about the insecure PRNG had been suppressed with # noqa: S311 rather than addressed, underscoring the risk of silencing security linter warnings (urwid Issue #1127, urwid PR #1128).