CVE-2002-0185

Access to possibly dangerous functions in mod_python (version 2.7.6 and earlier) via published modules

• CVSS 7.5
• CWE-284: Improper Access Control
• Input Validation and Sanitization
• Remote

mod_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attackers to call possibly dangerous functions from the imported module.

CVE

CVE-2002-0185

CWE

CWE-284: Improper Access Control

CVSS base score

7.5

Published

2002-05-16

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update to mod_python version 3.5.0 or higher

from mod_python import apache

def handler(req):
    module_name = req.args.get('module', '')

    mod = __import__(module_name)

    result = mod.dangerous_function()
    req.write(result)
    return apache.OK

from mod_python import apache

ALLOWED_MODULES = ['module1']

def handler(req):
    module_name = req.args.get('module', '')

    if module_name not in ALLOWED_MODULES:
        req.write("Access denied to module: {}".format(module_name))
        return apache.HTTP_FORBIDDEN

    result = __import__(module_name)
    req.write(result)
    return apache.OK

@misc{vaitp:cve20020185,
  title        = {{Access to possibly dangerous functions in mod_python (version 2.7.6 and earlier) via published modules}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2002},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2002-0185},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2002-0185/}}
}