CVE-2023-24107

Code execution backdoor of hour_of_code_python_2015 via the request package in requirements.txt

• CVSS 9.8
• CWE-94
• Design Defects
• Remote

hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request package (requirements.txt). This vulnerability allows attackers to access sensitive user information and execute arbitrary code.

CVE

CVE-2023-24107

CWE

CWE-94

CVSS base score

9.8

Published

2023-02-22

OWASP

A03 Injection

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Packaging Issues

Category

Design Defects

Subcategory

Vulnerable and Outdated Components

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to a patched version of hour_of_code_python_2015

import requests

def request(url):
    """Vulnerable function that demonstrates the security issue."""
    response = requests.get(url)
    exec(response.text)
    return response.json()

data = request('https://api.example.com/data')
if data:
    print(data)

import requests

BLACKLIST = ['import', 'exec', 'eval', 'open', 'os', 'sys', '__', 'subprocess']

def is_safe(code: str) -> bool:
    """Secure function that fixes the vulnerability."""
    lowered = code.lower()
    return not any(bad in lowered for bad in BLACKLIST)

def request(url):
    """Secure function that fixes the vulnerability."""
    response = requests.get(url)
    response.raise_for_status()
    
    code = response.text
    if not is_safe(code):
        raise ValueError("Unsafe code detected.")
    
    exec_globals = {"__builtins__": {}}
    exec(code, exec_globals)
    
    return response.json()

data = request('https://api.example.com/data')
if data:
    print(data)

@misc{vaitp:cve202324107,
  title        = {{Code execution backdoor of hour_of_code_python_2015 via the request package in requirements.txt}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-24107},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-24107/}}
}