CVE-2016-9950

Path traversal in Apport <= 2.20.4 allows Python file execution

• CVSS 7.8
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Local

An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.

CVE

CVE-2016-9950

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.8

Published

2016-12-17

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Apport to version 2.20.4 or higher.

import os

def get_package_hook(package_name):
    """Vulnerable function that demonstrates the security issue."""
    # VULNERABLE: This code is susceptible to path traversal
    hook_path = os.path.join('/usr/share/apport/package-hooks/', package_name + '.py')

    if os.path.isfile(hook_path):
        with open(hook_path) as hook_file:
            exec(hook_file.read())
    else:
        raise FileNotFoundError(f"Hook file for package {package_name} not found.")

import os

def sanitize_package_name(package_name):
    """Secure function that fixes the vulnerability."""
    return os.path.basename(package_name)

def get_package_hook(package_name):
    """Secure function that fixes the vulnerability."""
    sanitized_package_name = sanitize_package_name(package_name)
    hook_path = os.path.join('/usr/share/apport/package-hooks/', sanitized_package_name + '.py')

    if os.path.isfile(hook_path):
        with open(hook_path) as hook_file:
            exec(hook_file.read())
    else:
        raise FileNotFoundError(f"Hook file for package {sanitized_package_name} not found.")

@misc{vaitp:cve20169950,
  title        = {{Path traversal in Apport <= 2.20.4 allows Python file execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2016},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2016-9950},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-9950/}}
}