Vulnerable code sample

import subprocess
import os
import sys

# --- Simulated pyLoad Environment ---
# This code represents a vulnerable state of an application similar to pyLoad
# before the fix for CVE-2026-35463 was applied.

# A mock user system. The current user has 'SETTINGS' permissions but is not an admin.
CURRENT_USER = {"username": "standard_user", "role": "user"}
ROLES = {
    "admin": ["SETTINGS", "ADMIN_ACCESS"],
    "user": ["SETTINGS"]
}

# The application's configuration store.
CONFIG = {
    "core": {
        "reconnect_script": "/usr/bin/default_reconnect.sh",
        "ssl_cert": "/etc/ssl/certs/pyload.pem"
    },
    "plugins": {
        "AntiVirus": {
            "enabled": True,
            "avfile": "/usr/bin/antivirus_engine",  # The executable path for the AV plugin
            "avargs": "--scan",
        }
    }
}

# A list of security-critical options that should only be writable by an admin.
# The vulnerability exists because this list only protects 'core' options.
ADMIN_ONLY_OPTIONS = {"reconnect_script", "ssl_cert", "proxy_credentials"}

# --- Vulnerable Application Logic ---

def has_permission(user, permission):
    """Checks if a user's role grants them a specific permission."""
    user_role = user.get("role", "")
    return permission in ROLES.get(user_role, [])

def is_admin(user):
    """Checks if the user has the 'admin' role."""
    return user.get("role") == "admin"

def set_plugin_config_value(plugin_name, key, value):
    """A helper to set plugin-specific configuration values."""
    try:
        CONFIG["plugins"][plugin_name][key] = value
        print(f"[INFO] User '{CURRENT_USER['username']}' set 'plugins.{plugin_name}.{key}' to '{value}'.")
    except KeyError:
        print(f"[ERROR] Plugin config path 'plugins.{plugin_name}.{key}' not found.")

def set_config_value(section, key, value):
    """
    Sets a configuration value.
    This function contains the vulnerability. It restricts access to sensitive 'core'
    options but fails to apply the same protection to 'plugin' options.
    """
    if not has_permission(CURRENT_USER, "SETTINGS"):
        print(f"[ACCESS DENIED] User '{CURRENT_USER['username']}' lacks 'SETTINGS' permission.")
        return

    # The protection mechanism is ONLY applied to the 'core' section.
    if section == "core" and key in ADMIN_ONLY_OPTIONS:
        if not is_admin(CURRENT_USER):
            print(f"[ACCESS DENIED] User '{CURRENT_USER['username']}' is not an admin and cannot change '{key}'.")
            return
        else:
            CONFIG[section][key] = value
            print(f"[INFO] Admin '{CURRENT_USER['username']}' set 'core.{key}' to '{value}'.")
    # VULNERABILITY: No admin check is performed for the 'plugins' section.
    # A non-admin user with 'SETTINGS' permission can modify any plugin config.
    elif section == "plugins":
        # In the real app, the key might be complex (e.g., "AntiVirus.avfile").
        # Here we simulate by assuming the key identifies the plugin and option.
        plugin_name, plugin_key = key.split('.')
        set_plugin_config_value(plugin_name, plugin_key, value)
    else:
        print(f"[INFO] Setting non-critical option '{section}.{key}'.")
        CONFIG[section][key] = value


def trigger_antivirus_scan(file_to_scan):
    """
    This function simulates the AntiVirus plugin scanning a file, which acts
    as the trigger for the remote code execution.
    """
    antivirus_config = CONFIG["plugins"]["AntiVirus"]
    if not antivirus_config["enabled"]:
        return

    # The 'avfile' path is read from the config, which an attacker can now control.
    av_executable = antivirus_config["avfile"]
    av_args = antivirus_config["avargs"]

    # The command is constructed and executed, often with a shell for convenience.
    command_to_run = f'"{av_executable}" {av_args} {file_to_scan}'

    # The sink: The attacker-controlled 'av_executable' is executed.
    print(f"\n[TRIGGER] Executing antivirus command: {command_to_run}")
    try:
        # Using shell=True is a common pattern that makes this type of
        # command injection vulnerability easily exploitable.
        subprocess.Popen(command_to_run, shell=True)
    except Exception as e:
        print(f"[ERROR] Failed to execute subprocess: {e}")

if __name__ == '__main__':
    print("--- DEMONSTRATING CVE-2026-35463 VULNERABILITY ---")
    print(f"[*] Current user: {CURRENT_USER['username']} (Role: {CURRENT_USER['role']})")
    print(f"[*] Initial AV executable path: {CONFIG['plugins']['AntiVirus']['avfile']}\n")

    # 1. A non-admin user attempts to change a protected 'core' option (this will fail).
    print("--- Step 1: Attacker tries to change a protected 'core' option (EXPECTED TO FAIL) ---")
    set_config_value("core", "reconnect_script", "malicious_script.sh")
    print(f"[*] Core reconnect script remains: {CONFIG['core']['reconnect_script']}\n")

    # 2. The same non-admin user changes the 'avfile' path for the AntiVirus plugin.
    #    This succeeds because the ADMIN_ONLY_OPTIONS check is not applied to plugins.
    print("--- Step 2: Attacker changes unprotected 'plugin' option (EXPECTED TO SUCCEED) ---")
    if sys.platform == "win32":
        # On Windows, open the calculator. The '#' is a comment to discard the rest of the command.
        malicious_payload = "calc.exe #"
    else:
        # On Linux/macOS, create a file in /tmp to prove execution.
        malicious_payload = "touch /tmp/cve_exploited #"

    set_config_value("plugins", "AntiVirus.avfile", malicious_payload)
    print(f"[*] New AV executable path: {CONFIG['plugins']['AntiVirus']['avfile']}\n")

    # 3. Later, the application triggers a routine scan. This executes the attacker's payload.
    print("--- Step 3: Application triggers the vulnerable function, executing the payload ---")
    trigger_antivirus_scan("/downloads/some_file.zip")

    print("\n--- Step 4: Verifying the exploit's success ---")
    if sys.platform != "win32":
        if os.path.exists("/tmp/cve_exploited"):
            print("[SUCCESS] Exploit successful! '/tmp/cve_exploited' was created.")
            os.remove("/tmp/cve_exploited")  # Clean up
        else:
            print("[FAILURE] Exploit did not create the expected file.")
    else:
        print("[SUCCESS] If the exploit worked, Calculator should have launched.")