CVE-2011-3587
Unspecified Zope 2.12.x and 2.13.x vulnerability allows remote command execution via OFS/misc_.py and Python modules
- CVSS 9.3
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
- Input Validation and Sanitization
- Remote
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
- CVSS base score
- 9.3
- Published
- 2011-10-10
- OWASP
- A03 Injection
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Input Validation and Sanitization
- Subcategory
- Command Injection
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Fixed by upgrading
- Yes
Solution
Update Zope to a version higher than 2.13.x.
Vulnerable code sample
import os
class ExampleClass:
def execute_command(self, command):
"""Vulnerable function that demonstrates the security issue."""
os.system(command)
instance = ExampleClass()
instance.execute_command("rm -rf /")Patched code sample
import os
import shlex
class ExampleClass:
def __init__(self):
"""Secure function that fixes the vulnerability."""
# SECURE: This version prevents command injection
self.blacklist = [
"rm",
"rf",
"/",
";",
"&",
"|",
">",
"<",
"`",
"$",
"(",
")",
"\\",
"sudo",
"mv",
"dd",
"cat >",
"echo >"
]
def is_blacklisted(self, part):
"""Secure function that fixes the vulnerability."""
part = part.lower()
for item in self.blacklist:
if item in part:
return True
return False
def execute_command(self, command):
"""Secure function that fixes the vulnerability."""
parts = shlex.split(command)
for part in parts:
if self.is_blacklisted(part):
print(f"Error: Suspicious command part detected: {part}")
return
print(f"Executing (with blacklist attempt): {command}")
os.system(command)
instance = ExampleClass()
instance.execute_command("rm -rf /")Cite this entry
@misc{vaitp:cve20113587,
title = {{Unspecified Zope 2.12.x and 2.13.x vulnerability allows remote command execution via OFS/misc_.py and Python modules}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2011},
note = {VAITP Python Vulnerability Dataset, entry CVE-2011-3587},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2011-3587/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::