CVE-2010-2235
Cobbler template API allows remote code execution via crafted kickstart templates
- CVSS 8.5
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- Input Validation and Sanitization
- Remote
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
- CVSS base score
- 8.5
- Published
- 2010-12-09
- OWASP
- A03 Injection
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Fixed by upgrading
- Yes
Solution
Update Cobbler to version 2.0.7 or higher.
Vulnerable code sample
from Cheetah.Template import Template
def render_template(template_string, **context):
"""Vulnerable function that demonstrates the security issue."""
template = Template(template_string, searchList=[context])
return str(template)
template_string = """
<%
import os
os.system('echo Vulnerable!') # Arbitrary code execution
%>
Hello, $name!
"""
context = {'name': 'World'}
output = render_template(template_string, **context)
print(output)Patched code sample
import re
from typing import Any, Dict, Optional, Set, Union
from Cheetah.Template import Template
from Cheetah.Compiler import Compiler
from Cheetah.NameMapper import NotFound
class TemplateError(Exception):
pass
class Template:
MAX_SIZE = 1024 * 1024
MAX_DEPTH = 10
MAX_ITERATIONS = 1000
RESTRICTED_NAMES = {
'__class__', '__dict__', '__bases__', '__globals__',
'eval', 'exec', 'globals', 'locals', 'dir',
'open', 'file', 'read', 'write',
'os', 'sys', 'subprocess', 'popen'
}
TEMPLATE_PATTERN = r'^[^<>{}]*$'
def __init__(
self,
max_size: Optional[int] = None,
max_depth: Optional[int] = None,
max_iterations: Optional[int] = None
):
try:
self.max_size = max_size or self.MAX_SIZE
self.max_depth = max_depth or self.MAX_DEPTH
self.max_iterations = max_iterations or self.MAX_ITERATIONS
except Exception as e:
raise TemplateError(f"Initialization failed: {str(e)}")
def _validate_template(self, template_string: str) -> None:
"""Secure function that fixes the vulnerability."""
try:
if len(template_string.encode('utf-8')) > self.max_size:
raise TemplateError("Template too large")
if not re.match(self.TEMPLATE_PATTERN, template_string):
raise TemplateError("Invalid template format")
blacklist_patterns = [
r'\$\{.*?\}',
r'\{\%.*?\%\}',
r'\{\{.*?\}\}',
r'<\?.*?\?>',
r'<script.*?>.*?</script>',
r'javascript:',
r'data:',
r'vbscript:'
]
for pattern in blacklist_patterns:
if re.search(pattern, template_string, re.IGNORECASE):
raise TemplateError("blacklist template pattern")
except Exception as e:
if isinstance(e, TemplateError):
raise
raise TemplateError(f"Template validation failed: {str(e)}")
def _validate_context(self, context: Dict[str, Any]) -> None:
"""Secure function that fixes the vulnerability."""
try:
for key in context:
if key in self.RESTRICTED_NAMES:
raise TemplateError(f"Restricted context key: {key}")
for value in context.values():
if callable(value):
raise TemplateError("Callable values not allowed")
except Exception as e:
if isinstance(e, TemplateError):
raise
raise TemplateError(f"Context validation failed: {str(e)}")
def _sanitize_value(self, value: Any) -> str:
"""Secure function that fixes the vulnerability."""
try:
value_str = str(value)
value_str = value_str.replace('&', '&')
value_str = value_str.replace('<', '<')
value_str = value_str.replace('>', '>')
value_str = value_str.replace('"', '"')
value_str = value_str.replace("'", ''')
return value_str
except Exception as e:
raise TemplateError(f"Value sanitization failed: {str(e)}")
def render(
self,
template_string: str,
context: Optional[Dict[str, Any]] = None
) -> str:
try:
self._validate_template(template_string)
modified_context = {}
if context:
self._validate_context(context)
modified_context = {
key: self._sanitize_value(value)
for key, value in context.items():
}
template = Template(
template_string,
searchList=[modified_context],
compilerSettings={
'useAutocalling': False,
'useNameMapper': False,
'useFilters': True
}
)
template.compiler.setMaxDepth(self.max_depth)
template.compiler.setMaxIterations(self.max_iterations)
return str(template)
except NotFound as e:
raise TemplateError(f"Template variable not found: {str(e)}")
except Exception as e:
if isinstance(e, TemplateError):
raise
raise TemplateError(f"Template rendering failed: {str(e)}")Cite this entry
@misc{vaitp:cve20102235,
title = {{Cobbler template API allows remote code execution via crafted kickstart templates}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2010},
note = {VAITP Python Vulnerability Dataset, entry CVE-2010-2235},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2010-2235/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::