CVE-2024-29073: 
Python vulnerability analysis and mitigation

An arbitrary file read vulnerability (CVE-2024-29073) was discovered in Ankitects Anki version 24.04. The vulnerability exists in the handling of LaTeX content, where the verbatim package, which comes installed by default in many LaTeX distributions, was overlooked during the sanitization process of unsafe commands. The vulnerability was discovered by Autumn Bee Skerritt of Cisco Duo Security and Jacob B, and was publicly disclosed on July 22, 2024 (Talos Report).

The vulnerability stems from incomplete sanitization of LaTeX commands in Anki's flashcard system. While Anki implements a blocklist to prevent the use of commands that read file descriptors, the verbatim package command was overlooked. An attacker can exploit this by crafting a special card header section that loads the verbatim package and subsequently abuse its functionality through the verbatiminput tag. The vulnerability has been assigned a CVSS v3.1 score of 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, and is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) (Talos Report).

The vulnerability allows an attacker to perform arbitrary file reads on the target system. Additionally, it can be used to gather system information and list directories/files. The attacker can retrieve the results by exploiting the fact that the content is associated with the HTML document tag 'img.latex' and using JavaScript code in the card template to exfiltrate the data to an attacker-controlled server (Talos Report).

The vulnerability can be triggered by sharing a specially crafted flashcard with a target user. Anki's design allows users to publicly share their decks, and there are no warnings or checks in place to prevent using cards from other users. The exploitation requires the target to have a LaTeX handler installed (such as MiKTeX for Windows users) (Talos Report).

The vulnerability was patched with a vendor release on June 24, 2024. Users should update to a version newer than Anki 24.04 to protect against this vulnerability (Talos Report).