CVE-2018-20852

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python < 3.7.3

• CVSS 5.3
• CWE-20 Improper Input Validation
• Information Leakage
• Remote

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This vulnerability affects Python versions 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

CVE

CVE-2018-20852

CWE

CWE-20 Improper Input Validation

CVSS base score

5.3

Published

2019-07-13

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Upgrade to Python 3.7.3 or higher.

import os

def read_user_file(filename):
    # Vulnerable: Direct file access without path validation
    # This allows path traversal attacks
    try:
        with open(filename, 'r') as f:
            return f.read()
    except Exception as e:
        return f"Error: {e}"

# Example of vulnerable usage:
# malicious_path = "../../../etc/passwd"
# read_user_file(malicious_path)  # Path traversal attack!

import os
from pathlib import Path

def read_user_file(filename):
    # Secure: Validate and restrict file access to safe directory
    SAFE_DIRECTORY = "/var/app/user_files"
    
    try:
        # Resolve the full path and check if it's within safe directory
        safe_path = Path(SAFE_DIRECTORY).resolve()
        requested_path = Path(os.path.join(SAFE_DIRECTORY, filename)).resolve()
        
        # Check if the resolved path is within the safe directory
        if not str(requested_path).startswith(str(safe_path)):
            raise ValueError("Path traversal attempt detected")
        
        # Additional check for file existence and readability
        if not requested_path.exists() or not requested_path.is_file():
            raise ValueError("File not found or not accessible")
        
        with open(requested_path, 'r') as f:
            return f.read()
    except Exception as e:
        return f"Error: {e}"

# Example of secure usage:
# read_user_file("document.txt")  # Safe file access within allowed directory

@misc{vaitp:cve201820852,
  title        = {{http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python < 3.7.3}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-20852},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-20852/}}
}