Vulnerable code sample

import os
import argparse
import subprocess
import sys

# This is a simplified, representative model of the vulnerable code structure
# described in the CVE. It is not the actual source code of the 'backpropagate' library.

# This would conceptually be in a file like `backpropagate/cli.py`
def main():
    """The CLI entrypoint that incorrectly handles authentication."""
    parser = argparse.ArgumentParser(
        description="Backpropagate UI Launcher (Vulnerable Example)"
    )
    parser.add_argument(
        "--auth",
        type=str,
        default=None,
        help="Require HTTP Basic authentication on every request to the UI."
    )
    parser.add_argument(
        "--share",
        action="store_true",
        help="Expose the UI on a public address; requires --auth."
    )

    args = parser.parse_args()

    # Create an environment for the subprocess
    env = os.environ.copy()

    if args.auth:
        try:
            username = args.auth.split(':')[0]
            print(f"Auth: enabled (user: {username})")
        except IndexError:
            print("Error: Invalid auth format. Expected user:pass", file=sys.stderr)
            sys.exit(1)

        # The CLI sets the environment variable as documented.
        env['BACKPROPAGATE_UI_AUTH'] = args.auth
        # For Phase 1 the variable is exported but Reflex doesn't read it yet.

    # In the actual library, this launches the Reflex UI app.
    # We simulate this by calling a separate Python script as a subprocess.
    # The vulnerability lies in the fact that `ui_app.py` never uses the env var.
    print("Starting Web UI...")
    # We pass the --share flag to the UI app to control the listening address.
    cmd = [sys.executable, "-c", "from ui_app import run; run()", f"--share={args.share}"]
    subprocess.run(cmd, env=env)


# This would conceptually be in a file like `backpropagate/ui_app/main.py`
# We'll embed it here as a string executed by the subprocess for a single-file example.
UI_APP_CODE = """
import argparse
from flask import Flask, jsonify, request

# This is a stand-in for the actual Reflex web application.
# Flask is used here for simplicity to demonstrate the core issue.
app = Flask(__name__)

# This environment variable is set by the launcher but is NEVER read by the UI app.
# AUTH_CREDS = os.environ.get('BACKPROPAGATE_UI_AUTH') # This line is missing.

@app.route("/")
def index():
    return "Backpropagate UI is running.", 200

@app.route("/api/upload-dataset", methods=["POST"])
def upload_dataset():
    # VULNERABILITY: No authentication check is performed.
    # Any client can access this sensitive endpoint.
    print("Received request to /api/upload-dataset")
    return jsonify({"status": "success", "message": "Dataset uploaded."}), 200

@app.route("/api/start-training", methods=["POST"])
def start_training():
    # VULNERABILITY: No authentication check is performed.
    # Any client can trigger a training run.
    print("Received request to /api/start-training")
    return jsonify({"status": "success", "message": "Training started."}), 200

def run():
    parser = argparse.ArgumentParser()
    parser.add_argument("--share", type=lambda x: (str(x).lower() == 'true'), default=False)
    args = parser.parse_args()

    host = "0.0.0.0" if args.share else "127.0.0.1"
    print(f"UI backend listening on http://{host}:8000")
    app.run(host=host, port=8000)

# We need a way to pass this code to the subprocess.
# A simple way is to create a temporary file.
with open("ui_app.py", "w") as f:
    f.write(UI_APP_CODE)
"""

if __name__ == "__main__":
    # Create the fake UI app file
    exec(UI_APP_CODE)
    # Run the main CLI function
    main()