CVE-2024-32023 (Python, published 2024-04-16T15:15Z)
Description: value: Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `find_and_replace` function. This vulnerability is fixed in 23.1.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bmaltais/kohya_ss
Files changed:
kohya_gui/basic_caption_gui.py
kohya_gui/blip_caption_gui.py
kohya_gui/class_basic_training.py
kohya_gui/common_gui.py
kohya_gui/git_caption_gui.py
kohya_gui/group_images_gui.py
kohya_gui/manual_caption_gui.py
kohya_gui/wd14_caption_gui.py
Commit message: Find replace (#2258)

* Improve security to limit finding and replacing contents of any files on the system, that the attacker knows the contents of by specifying the list of acceptable extensions for captions.

* Update caption extension fields to Dropdown with restricted choices for security reasons

Vulnerable code:
            caption_ext = gr.Textbox(
                placeholder="Extension for caption file (e.g., .caption, .txt)",
            caption_file_ext = gr.Textbox(
                placeholder="Extension for caption file (e.g., .caption, .txt)",
            self.caption_extension = gr.Textbox(
                label="Caption Extension",
                placeholder="(Optional) default: .caption",
                value=self.config.get("basic.caption_extension", ""),

    caption_files = [f for f in os.listdir(folder_path) if f.endswith(caption_file_ext)]
        with open(file_path, "r", errors="ignore") as f:
            content = f.read().replace(search_text, replace_text)

        # Write the updated content back to the file
        with open(file_path, "w") as f:
            f.write(content)
            caption_ext = gr.Textbox(
                placeholder="Extension for caption file (e.g., .caption, .txt)",
            caption_ext = gr.Textbox(
                label="Caption Extension",
                placeholder="Caption file extension (e.g., .txt)",
            caption_ext = gr.Textbox(
                placeholder="Extension for caption file (e.g., .caption, .txt)",
            caption_extension = gr.Textbox(
                placeholder="Extension for caption file (e.g., .caption, .txt)",
                value=config.get("wd14_caption.caption_extension", ".txt"),

Fixed code:
            caption_ext = gr.Dropdown(
                choices=[".cap", ".caption", ".txt"],
            caption_file_ext = gr.Dropdown(
                choices=[".cap", ".caption", ".txt"],
            self.caption_extension = gr.Dropdown(
                label="Caption file extension",
                choices=[".cap", ".caption", ".txt"],
                value=".txt",
                interactive=True,
    
    # Check if the caption file extension is one of the supported extensions
    if caption_file_ext not in [".caption", ".txt", ".txt2", ".cap"]:
        log.error(
            f"Unsupported file extension {caption_file_ext} for caption files. Please use .caption, .txt, .txt2, or .cap."
        )
        # Exit the function early
        return
    
    # Check if the folder path exists
    if not os.path.exists(folder_path):
        log.error(f"The provided path '{folder_path}' is not a valid folder.")
        return
    try:
        caption_files = [f for f in os.listdir(folder_path) if f.endswith(caption_file_ext)]
    except Exception as e:
        log.error(f"Error accessing folder {folder_path}: {e}")
        return
        try:
            with open(file_path, "r", errors="ignore") as f:
                content = f.read().replace(search_text, replace_text)

            # Write the updated content back to the file
            with open(file_path, "w") as f:
                f.write(content)
        except Exception as e:
            log.error(f"Error processing file {file_path}: {e}")
            caption_ext = gr.Dropdown(
                choices=[".cap", ".caption", ".txt"],
            caption_ext = gr.Dropdown(
                label="Caption file extension",
                choices=[".cap", ".caption", ".txt"],
            caption_ext = gr.Dropdown(
                choices=[".cap", ".caption", ".txt"],
            caption_extension = gr.Dropdown(
                choices=[".cap", ".caption", ".txt"],
                value=".txt",