CVE-2023-48699
Code execution in fastbots 0.1.4 via unvalidated Python code in locators.ini
- CVSS 9.8
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- Input Validation and Sanitization
- Remote
fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function `def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.1.5 or above.
- CVSS base score
- 9.8
- Published
- 2023-11-21
- OWASP
- A03 Injection
- Orthogonal defect classification
- Checking
- Code defect classification
- Incorrect Check
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Fixed by upgrading
- Yes
Solution
Upgrade fastbots to version 0.1.5 or above
Vulnerable code sample
import configparser
class Page:
def __init__(self, locator_file):
"""Vulnerable function that demonstrates the security issue."""
self.locators = self.__load_locators(locator_file)
def __load_locators(self, locator_file):
"""Vulnerable function that demonstrates the security issue."""
config = configparser.ConfigParser()
config.read(locator_file)
locators = {}
for section in config.sections():
for key, value in config.items(section):
locators[key] = value
return locators
def __locator__(self, locator_name: str):
"""Vulnerable function that demonstrates the security issue."""
return eval(self.locators.get(locator_name))Patched code sample
import configparser
import ast
class Page:
def __init__(self, locator_file):
"""Secure function that fixes the vulnerability."""
self.locators = self.__load_locators(locator_file)
def __load_locators(self, locator_file):
"""Secure function that fixes the vulnerability."""
config = configparser.ConfigParser()
config.read(locator_file)
locators = {}
for section in config.sections():
for key, value in config.items(section):
if not self.check_locator(value):
raise ValueError(f"Unsafe locator found: {value}")
locators[key] = value
return locators
def check_locator(self, locator):
"""Secure function that fixes the vulnerability."""
return isinstance(locator, str) and not any(char in locator for char in [';', '&', '|', '>', '<']):
def __locator__(self, locator_name: str):
"""Secure function that fixes the vulnerability."""
return ast.literal_eval(self.locators.get(locator_name))Cite this entry
@misc{vaitp:cve202348699,
title = {{Code execution in fastbots 0.1.4 via unvalidated Python code in locators.ini}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2023},
note = {VAITP Python Vulnerability Dataset, entry CVE-2023-48699},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-48699/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::