Pagination vulnerabilities #11

Activity

1. KevinHock commented on Apr 18, 2017

   

   KevinHock

   on Apr 18, 2017

   Collaborator

   More actions

   Do you have an example?
2. Thalmann commented on Apr 23, 2017

   

   Thalmann

   on Apr 23, 2017

   Last edited by Thalmann

   ContributorAuthor

   More actions

   When using flask pagination for instance on this project:
   https://github.com/luoluohang/flask_blog/blob/master/app/api_1_0/posts.py
   Running pyt on that project yields amongst others this potential vulnerability:

   luoluohang/flask_blog
   https://github.com/luoluohang/flask_blog
   Entry file: flask_blog/app/init.py
   Scanned: 2017-04-23 10:16:50.999286
   Vulnerability 1:
   File: flask_blog/app/api_1_0/posts.py

   User input at line 11, trigger word "get(":
   page = request.args.get('page', 1,type=int)
   Reassigned in:
   File: flask_blog/app/api_1_0/posts.py
   > Line 12: pagination = Post.query.paginate(page,per_page=current_app.config['FLASKY_POSTS_PER_PAGE'], error_out=False)
   File: flask_blog/app/api_1_0/posts.py
   > Line 14: posts = pagination.items
   File: flask_blog/app/api_1_0/posts.py
   > Line 15: prev = None
   File: flask_blog/app/api_1_0/posts.py
   > Line 18: next = None
   File: flask_blog/app/api_1_0/posts.py
   reaches line 17, trigger word "url_for(":
   prev = url_for('api.get_posts',page=page - 1, _external=True)

   Let me know if this makes sense :)
3. KevinHock commented on Apr 15, 2018

   

   KevinHock

   on Apr 15, 2018

   Collaborator

   More actions

   So I'm pretty sure this should be solved with the blackbox mapping

   (venv) Kevins-MacBook-Pro:pyt kevin$ python -m pyt -f foo.py -i
   /usr/local/Cellar/python3/3.6.1/Frameworks/Python.framework/Versions/3.6/lib/python3.6/runpy.py:125: RuntimeWarning: 'pyt.__main__' found in sys.modules after import of package 'pyt', but prior to execution of 'pyt.__main__'; this may result in unpredictable behaviour
     warn(RuntimeWarning(msg))
   Is the return value of ~call_2 = ret_Post.query.paginate(page, per_page=current_app.config['FLASKY_POSTS_PER_PAGE'], error_out=False) with tainted argument "page" vulnerable? (Y/n)n
   2 vulnerabilities found:
   Vulnerability 1:
   File: foo.py
    > User input at line 3, trigger word "request.args.get(":
   	 ~call_1 = ret_request.args.get('page', 1, type=int)
   Reassigned in:
   	File: foo.py
   	 > Line 3: page = ~call_1
   File: foo.py
    > reaches line 9, trigger word "url_for(":
   	~call_3 = ret_url_for('api.get_posts', page=page - 1, _external=True)
   
   Vulnerability 2:
   File: foo.py
    > User input at line 3, trigger word "request.args.get(":
   	 ~call_1 = ret_request.args.get('page', 1, type=int)
   Reassigned in:
   	File: foo.py
   	 > Line 3: page = ~call_1
   File: foo.py
    > reaches line 12, trigger word "url_for(":
   	~call_4 = ret_url_for('api.get_posts', page=page + 1, _external=True)
   
   (venv) Kevins-MacBook-Pro:pyt kevin$ git status
   On branch check_travis
   Changes not staged for commit:
     (use "git add <file>..." to update what will be committed)
     (use "git checkout -- <file>..." to discard changes in working directory)
   
   	modified:   foo.py
   	modified:   pyt/vulnerability_definitions/blackbox_mapping.json
   
   no changes added to commit (use "git add" and/or "git commit -a")
   (venv) Kevins-MacBook-Pro:pyt kevin$ git diff pyt/vulnerability_definitions/blackbox_mapping.json
   diff --git a/pyt/vulnerability_definitions/blackbox_mapping.json b/pyt/vulnerability_definitions/blackbox_mapping.json
   index fbb229e..124e0d4 100644
   --- a/pyt/vulnerability_definitions/blackbox_mapping.json
   +++ b/pyt/vulnerability_definitions/blackbox_mapping.json
   @@ -1,7 +1,8 @@
    {
        "does_not_propagate": [
            "fast_eddie",
   -        "url_for"
   +        "url_for",
   +        "Post.query.paginate"
        ],
        "propagates": [
            "os.path.join",
   (venv) Kevins-MacBook-Pro:pyt kevin$ 
4. KevinHock commented on Apr 15, 2018

   

   KevinHock

   on Apr 15, 2018

   Collaborator

   More actions

   As an aside: Why is url_for a sink? Maybe I don't know that much about Flask
5. KevinHock

   closed this as completedon Apr 16, 2018