CVE-2011-4212

Sandbox bypass via os.popen in Google App Engine Python SDK < 1.5.4

• CVSS 7.2
• CWE-264
• Input Validation and Sanitization
• Local

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a dev_appserver.RestrictedPathFunction._original_os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.

CVE

CVE-2011-4212

CWE

CWE-264

CVSS base score

7.2

Published

2011-10-30

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Google App Engine Python SDK to version 1.5.4 or higher.

import os

def execute_command(command):
    return os.popen(command).read()

def function():
    command_args = ["ls", "-la"]
    output = execute_command(command_args)
    return output

result = function()
print(result)

import subprocess

BLACKLIST = {"rm", "shutdown", "reboot", "curl", "wget", ":", ";", "&&", "|", "`", "$(", "mkfs", "dd"}

def check_blacklist(command_args):
    return not any(token in BLACKLIST for token in command_args)

def execute_command(command_args):
    if not check_blacklist(command_args):
        raise ValueError("Blocked command")
    result = subprocess.run(command_args, capture_output=True, text=True, check=True)
    return result.stdout

def function():
    command_args = ["ls", "-la"]
    output = execute_command(command_args)
    return output

result = function()
print(result)

@misc{vaitp:cve20114212,
  title        = {{Sandbox bypass via os.popen in Google App Engine Python SDK < 1.5.4}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2011},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2011-4212},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2011-4212/}}
}