CVE-2024-27171

Insecure upload allows remote code execution via Python file overwrite.

• CVSS 7.4
• CWE-276
• Input Validation and Sanitization
• Remote

A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products/models/versions, see the reference URL.

CVE

CVE-2024-27171

CWE

CWE-276

CVSS base score

7.4

Published

2024-06-14

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Python

Solution

Implement secure file upload mechanisms, including file type validation and storage outside the web root. Upgrade to the latest version provided in the reference URL if a patch is available.

import os
from flask import Flask, request

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        return "No file part", 400
    file = request.files['file']
    if file.filename == '':
        return "No selected file", 400
    file.save(os.path.join('/uploads', file.filename))
    return "File uploaded successfully", 200

if __name__ == '__main__':
    app.run()

import os
from flask import Flask, request, abort

app = Flask(__name__)

ALLOWED_EXTENSIONS = {'txt', 'pdf', 'png', 'jpg', 'jpeg', 'gif'}

def allowed_file(filename):
    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

@app.route('/upload', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        abort(400, "No file part")
    file = request.files['file']
    if file.filename == '':
        abort(400, "No selected file")
    if file and allowed_file(file.filename):
        join_path = os.path.join('/upload/directory', file.filename)
        file.save(join_path)
        return "File uploaded successfully", 200
    else:
        abort(400, "File type not allowed")

if __name__ == '__main__':
    app.run()

# Exploit payload example
print("import os; os.system('whoami')")

@misc{vaitp:cve202427171,
  title        = {{Insecure upload allows remote code execution via Python file overwrite.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-27171},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-27171/}}
}