CVE-2022-46609

Code execution backdoor in Python3-RESTfulAPI via request package

• CVSS 9.8
• CWE-506: Embedded Malicious Code
• Input Validation and Sanitization
• Remote

Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

CVE

CVE-2022-46609

CWE

CWE-506: Embedded Malicious Code

CVSS base score

9.8

Published

2022-12-14

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Python3-RESTfulAPI to a version that does not contain the code execution backdoor

from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/api/data', methods=['POST'])
def handle_data():
    user_input = request.json.get('data', '')
    
    print(user_input)

    return jsonify({"message": "Data processed"}), 200

if __name__ == '__main__':
    app.run(debug=True)

from flask import Flask, request, jsonify

app = Flask(__name__)

BLACKLISTED_KEYWORDS = ['import', 'open', 'exec', 'eval', '__', 'os', 'sys', 'subprocess', 'input', 'globals', 'locals', 'compile']

def check_code(code):
    lowered = code.lower()
    return not any(kw in lowered for kw in BLACKLISTED_KEYWORDS)

@app.route('/api/data', methods=['POST'])
def handle_data():
    user_input = request.json.get('data', '')

    print(user_input)

    return jsonify({"message": "Code executed safely"}), 200

if __name__ == '__main__':
    app.run(debug=False)

@misc{vaitp:cve202246609,
  title        = {{Code execution backdoor in Python3-RESTfulAPI via request package}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-46609},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-46609/}}
}