Vulnerable code sample

import os
import shutil
from flask import Flask, session, request, send_from_directory, jsonify
from flask.sessions import FileSystemSessionInterface

# --- Application Setup ---
# This setup simulates the environment described in the CVE.

# Define key directories. The vulnerability lies in not protecting SESSION_DIR.
PKG_DIR = "/opt/pyload/app"
USER_DIR = "/home/user/.pyload"
SESSION_DIR = "/tmp/pyload/flask"  # The unprotected session directory
DOWNLOAD_DIR = "/home/user/downloads"  # Default safe storage folder

# Create directories for the demo to run
os.makedirs(SESSION_DIR, exist_ok=True)
os.makedirs(DOWNLOAD_DIR, exist_ok=True)

app = Flask(__name__)
# Use a file-based session interface to store session data in files
app.config["SESSION_TYPE"] = "filesystem"
app.config["SESSION_FILE_DIR"] = SESSION_DIR
app.secret_key = os.urandom(24)
app.session_interface = FileSystemSessionInterface(
    app.config["SESSION_FILE_DIR"], threshold=500, mode=384
)


# --- Vulnerable Code ---

# Global configuration state, similar to how pyLoad manages it.
# An attacker's goal is to change 'storage_folder' to SESSION_DIR.
CONFIG = {"storage_folder": DOWNLOAD_DIR}


def is_path_forbidden(path):
    """
    Simulates the incomplete fix for a previous CVE.
    It prevents setting storage_folder to PKGDIR or USERDIR but
    misses the Flask session directory.
    """
    forbidden_paths = [os.path.abspath(PKG_DIR), os.path.abspath(USER_DIR)]
    target_path = os.path.abspath(path)

    for forbidden in forbidden_paths:
        if target_path.startswith(forbidden):
            return True  # Path is forbidden
    return False  # Path is allowed


@app.route("/api/setConfig", methods=["POST"])
def set_config():
    """
    Authenticated endpoint allowing users to change configuration.
    The vulnerability is triggered here by setting 'storage_folder'
    to the session directory path.
    """
    # In a real scenario, this endpoint would require authentication.
    key = request.json.get("key")
    value = request.json.get("value")

    if key == "storage_folder":
        # The flawed security check is called here.
        if is_path_forbidden(value):
            return jsonify({"error": "Path is not allowed"}), 403

        # The check passes for the session directory, and the
        # configuration is updated with the malicious path.
        CONFIG["storage_folder"] = value
        return jsonify(
            {"status": "success", "message": f"storage_folder updated to {value}"}
        )

    return jsonify({"error": "Invalid key"}), 400


@app.route("/files/get/<path:filename>")
def get_file(filename):
    """
    This endpoint serves files from the configured 'storage_folder'.
    It blindly trusts the path in the CONFIG dictionary. If an attacker
    has pointed 'storage_folder' to the session directory, this function
    will serve session files of other users.
    """
    # No validation is performed here; it trusts the global config.
    storage_directory = CONFIG["storage_folder"]

    # The function serves a file from the potentially compromised directory.
    try:
        return send_from_directory(storage_directory, filename, as_attachment=True)
    except FileNotFoundError:
        return "File not found", 404


@app.route("/")
def index():
    """
    A sample route to create a session file for a visitor.
    This simulates a victim user accessing the application.
    The session file contains sensitive data.
    """
    session["user_id"] = "victim_user_123"
    session["role"] = "admin"
    return f"Welcome. A session file has been created for you in {SESSION_DIR}"