CVE-2024-32152: 
Python vulnerability analysis and mitigation

A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04, tracked as CVE-2024-32152. The vulnerability was discovered by Autumn Bee Skerritt of Cisco Duo Security and Jacob B, and was disclosed to the vendor on May 27, 2024. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path, which can be triggered when an attacker shares a malicious flashcard with a target user (Talos Report).

The vulnerability exists in Anki's LaTeX functionality, which is used to display images and TeX models in flashcards. While Anki implements a blocklist to prevent dangerous TeX commands that could read or write files, this protection can be bypassed using hex characters. The vulnerability requires MiKTeX to be installed as suggested by Anki's documentation. The CVSS v3.1 score is 3.1 (Low) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating that it requires user interaction and has low impact (Talos Report).

When exploited, the vulnerability allows an attacker to create a file with arbitrary content in the application's temp directory (specifically /tmp/anki/ in Linux and c:\Users\AppData\Local\Temp\anki_temp\ in Windows). The vulnerability takes advantage of Anki's normal behavior of allowing users to share decks publicly, with no warnings or checks in place to prevent using cards from other users (Talos Report).

The vulnerability can be exploited by sharing a specially crafted malicious flashcard with a target user. The attack leverages hex character substitution to bypass Anki's command blocklist. For example, replacing 't' with its hex code '^^74' allows dangerous commands like \openout and \write to be executed despite being on the blocklist (Talos Report).

The vendor released a patch for this vulnerability on June 24, 2024. Users should update their Anki installation to a version newer than 24.04 to protect against this vulnerability (Talos Report).