CVE-2022-28802

Code by Zapier pre-2022-08-17: Intra-account privilege escalation

• CVSS 9.9
• CWE-732 Incorrect Permission Assignment for Critical Resource
• Authentication, Authorization, and Session Management
• Remote

Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company's account, but was supposed to enforce role-based access control within that company's account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials – or other secrets – that weren't supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)

CVE

CVE-2022-28802

CWE

CWE-732 Incorrect Permission Assignment for Critical Resource

CVSS base score

9.9

Published

2022-09-21

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update Code by Zapier to version after 2022-08-17 to fix the vulnerability.

class User:
    def __init__(self, username):
        self.username = username

class VirtualMachine:
    def __init__(self):
        self.user_sessions = {}

    def login(self, user):
        self.user_sessions[user.username] = user
        print(f"{user.username} logged in successfully.")

    def execute_code(self, user, code):
        if user.username in self.user_sessions:
            print(f"Executing code for user {user.username}:")
        else:
            print(f"User  {user.username} is not logged in.")

class User:
    def __init__(self, username, role):
        self.username = username
        self.role = role

class VirtualMachine:
    def __init__(self):
        self.allowed_roles = ['admin', 'developer']
        self.user_sessions = {}

    def login(self, user):
        if user.role in self.allowed_roles:
            self.user_sessions[user.username] = user
            print(f"{user.username} logged in successfully.")
        else:
            print(f"Access denied for {user.username}. Insufficient privileges.")

    def execute_code(self, user, code):
        if user.username in self.user_sessions:
            print(f"Executing code for user {user.username}:")
        else:
            print(f"User {user.username} is not logged in.")

    def contains_blacklisted_keywords(self, code):
        blacklist = ['import', '__import__', 'eval', 'exec', 'os', 'sys', 'subprocess', 'open', 'input', 'lambda']
        return any(bad_word in code for bad_word in blacklist)

@misc{vaitp:cve202228802,
  title        = {{Code by Zapier pre-2022-08-17: Intra-account privilege escalation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-28802},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-28802/}}
}