CVE-2023-0057

Improper UI layer restriction in pyload (before 0.5.0b3.dev33) allows unauthorized access

• CVSS 6.1
• CWE-1021 Improper Restriction of Rendered UI Layers or Frames
• Input Validation and Sanitization
• Remote

Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.

CVE

CVE-2023-0057

CWE

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

CVSS base score

6.1

Published

2023-01-05

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update pyload to version 0.5.0b3.dev33 or higher.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

@misc{vaitp:cve20230057,
  title        = {{Improper UI layer restriction in pyload (before 0.5.0b3.dev33) allows unauthorized access}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-0057},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-0057/}}
}