CVE-2020-7698

Unsanitized input in Gerapy package (0 to 0.9.3) via Popen in project_configure endpoint

• CVSS 9.8
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• Input Validation and Sanitization
• Remote

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.

CVE

CVE-2020-7698

CWE

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS base score

9.8

Published

2020-07-29

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Gerapy to version 0.9.3 or higher.

import subprocess
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/project_configure', methods=['POST'])
def project_configure():
    """Vulnerable function that demonstrates the security issue."""
    command = request.json.get('command', '')

    process = subprocess.Popen(command, shell=True)
    process.wait()

    return jsonify({"status": "success", "pid": process.pid})

if __name__ == '__main__':
    app.run()

import subprocess
import shlex
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/project_configure', methods=['POST'])
def project_configure():
    """Secure function that fixes the vulnerability."""
    command = request.json.get('command', '')

    safe_command = shlex.quote(command)

    process = subprocess.Popen(safe_command, shell=True)
    process.wait()

    return jsonify({"status": "success", "pid": process.pid})

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve20207698,
  title        = {{Unsanitized input in Gerapy package (0 to 0.9.3) via Popen in project_configure endpoint}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-7698},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-7698/}}
}