Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis focused on two primary vulnerabilities described in the advisory: an arbitrary file write and a denial-of-service (DoS) due to uncontrolled resource consumption (decode-bomb). By comparing the git tags for the vulnerable version (1.3.0) and the patched version (1.3.1), I identified a series of commits that addressed these security issues.
For the arbitrary file write, the key vulnerable function was validate_output_path in src/phantom/_utils.py. In the vulnerable version, this function performed no checks if the PHANTOM_OUTPUT_DIR environment variable was unset, allowing any path to be used for output. The patch corrected this by enforcing a default sandboxed output directory (~/.phantom/output). Related functions like _resolve_output_path were also modified to ensure that default output files were created within this confined directory.
For the decode-bomb DoS, the functions separate_stems and render were identified as vulnerable. These functions processed audio files using demucs and ffmpeg respectively, without imposing any limits on the input file size or duration. This allowed a specially crafted compressed audio file to exhaust system memory upon decoding. The patch introduced a new function, enforce_decode_limits, which is now called by separate_stems and load_audio to check file properties before decoding. The render function was updated to pass resource-limiting flags directly to ffmpeg.
Additionally, a Time-of-Check, Time-of-Use (TOCTOU) vulnerability was found and fixed in the load_audio function, which could have allowed an attacker to switch a file after its path was validated. This was fixed by opening the file with O_NOFOLLOW and using the resulting file descriptor for all operations.
Further defense-in-depth measures were also identified in the commits, such as protection against JSON parsing DoS in _load_user_profile and an aggregate memory limit in multi_stem_masking.
validate_output_pathsrc/phantom/_utils.py
separate_stemssrc/phantom/separation.py
rendersrc/phantom/cli/render.py
load_audiosrc/phantom/audio.py
_resolve_output_pathsrc/phantom/processing.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phantom-audio | pip | <= 1.3.0 | 1.3.1 |