CVE-2008-6547

FormEncode 1.0 allows access bypass via unapplied chained_validators in schema.py

• CVSS 7.5
• CWE-20 Improper Input Validation
• Input Validation and Sanitization
• Remote

schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.

CVE

CVE-2008-6547

CWE

CWE-20 Improper Input Validation

CVSS base score

7.5

Published

2009-03-30

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update python-formencode to version 1.3.1 or higher.

from formencode import Schema, validators

class Schema(Schema):
    allow_extra_fields = False
    chained_validators = [validators.Int(), validators.String()]

    def validate(self, value):
        super().validate(value)

schema = Schema()
try:
    validated_data = schema.to_python({'field1': 123, 'field2': 'test'})
except validators.Invalid as e:
    print(f"Validation error: {e}")

from formencode import Schema, validators

class Schema(Schema):
    allow_extra_fields = False
    chained_validators = [validators.Int(), validators.String()]

    def validate(self, value):
        super().validate(value)
        if not self.is_accessible(value):
            raise validators.Invalid("Access denied", value)

    def is_accessible(self, value):
        return True

schema = Schema()
try:
    validated_data = schema.to_python({'field1': 123, 'field2': 'test'})
except validators.Invalid as e:
    print(f"Validation error: {e}")

@misc{vaitp:cve20086547,
  title        = {{FormEncode 1.0 allows access bypass via unapplied chained_validators in schema.py}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2009},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2008-6547},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2008-6547/}}
}