CVE-2011-4211

Google App Engine Python SDK < 1.5.4 – Sandbox FakeFile Bypass Vulnerability

• CVSS 7.2
• CWE-264
• Input Validation and Sanitization
• Local

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWED_MODES and ALLOWED_DIRS changes within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.

CVE

CVE-2011-4211

CWE

CWE-264

CVSS base score

7.2

Published

2011-10-30

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Google App Engine Python SDK to version 1.5.4 or higher.

def open(file_path, mode):
    return open(file_path, mode)

with open('/some_arbitrary_path/my_file.txt', 'w') as f:
    f.write('This could be any file!')

import os

ALLOWED_MODES = {'r', 'w', 'a'}
ALLOWED_DIRS = {'/allowed_directory/'}

def open(file_path, mode):
    if mode not in ALLOWED_MODES:
        raise ValueError("Invalid file mode.")
    
    normalized_path = os.path.normpath(file_path)
    if not any(normalized_path.startswith(os.path.normpath(allowed_dir)) for allowed_dir in ALLOWED_DIRS):
        raise ValueError("Access to this directory is not allowed.")
    
    return open(file_path, mode)

try:
    with open('/allowed_directory/my_file.txt', 'w') as f:
        f.write('Hello, World!')
except ValueError as e:
    print(e)

@misc{vaitp:cve20114211,
  title        = {{Google App Engine Python SDK < 1.5.4 - Sandbox FakeFile Bypass Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2011},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2011-4211},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2011-4211/}}
}