CVE-2023-40587

Exponential ReDoS in Snowflake-Connector-Python via get_file_transfer_type method

• CVSS 5.3
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Local

Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a `index.html` file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is `index.html`. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in `os.path.normpath` to no longer truncate on the first `0x00` found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.

CVE

CVE-2023-40587

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

5.3

Published

2023-08-25

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Pyramid to version 2.0.2 or higher.

from pyramid.config import Configurator
from pyramid.response import FileResponse
import os

def static_view(request):
    path = request.matchdict['path']
    full_path = os.path.normpath(os.path.join('/path/to/static/files', path))
    
    return FileResponse(full_path)

if __name__ == '__main__':
    with Configurator() as config:
        config.add_route('static', '/static/{path:.*}')
        config.add_view(static_view, route_name='static')
        app = config.make_wsgi_app()

from pyramid.config import Configurator
from pyramid.response import FileResponse
import os

def static_view(request):
    path = request.matchdict['path']
    if '\x00' in path:
        raise ValueError("Invalid path: null byte detected")

    base_directory = '/path/to/static/files'
    full_path = os.path.normpath(os.path.join(base_directory, path))

    if not full_path.startswith(os.path.abspath(base_directory)):
        raise ValueError("Invalid path: path traversal detected")

    return FileResponse(full_path)

if __name__ == '__main__':
    with Configurator() as config:
        config.add_route('static', '/static/{path:.*}')
        config.add_view(static_view, route_name='static')
        app = config.make_wsgi

@misc{vaitp:cve202340587,
  title        = {{Exponential ReDoS in Snowflake-Connector-Python via get_file_transfer_type method}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-40587},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-40587/}}
}