Repository navigation
[Python] Unsafe unpacking using shutil.unpack_archive() query and tests #719
Description
Query PR
Language
Python
CVE(s) ID list
- CVE-2022-23522
- CVE-2022-23530
- More to come soon.
CWE
CWE-022
Report
- Unsafe unpacking of a tarball retrieved from a remote location.
- A remotely downloaded tarball may be malicious and contains filename paths with relative path
..or absolute paths starting with/. It seems thatshutil.unpack_archive()does unpack tarballs with extensions.tar,.tar.gz,.tar.xz,.tar.bz2, or.gztarin an unsafe way. Which leads to the extraction of files within the tarball to an unintended folder. - I use a simple fact:
- Source: remote HTTP client request.
- Sink a call to
shutil.unpack_archive(). - additional taint steps: opening and writing the response to a tarball.
- Well, I removed a couple of in the python standard library cases.
- This CodeQL query is very specific but since the
shutil.unpack_archive()is unsafe, it could be extended to more sources. Here, I considered a remotely retrieved tarball, but in fact, any tarball input could be identified as malicious. For instance, a CLI tool that takes a path to a tarball in the filesystem is not yet identified with this CodeQL query.
Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
- Yes
- No
Activity
Sim4n6 commentedon Jan 2, 2023
I hate to say that but any update please related to this CodeQL query?
pwntester commentedon Jan 10, 2023
Hi @Sim4n6, thanks for yet another submission!
Sorry this one is taking so long but there was an ongoing inter-team discussion and, because of the different xmas breaks, it took longer to have everyone onboard. The query, as it is now, does not meet the minimum scope criteria to make it eligible for a bounty. We have been discussing different possibilities such as combining with other existing queries or making it a semantic query. While looking into the sink, @JarLob spotted that there are other similar and also vulnerable sinks (eg: tarfile and zipfile) that could be added to this query so increase its scope. Adding support for these additional sinks would increase the scope score and make it eligible. Would you willing to do so?
Sim4n6 commentedon Jan 10, 2023
Sure why not, but one detail please tarslip and zipslip queries are already available in the experimental queries do you suggest that I update them accordingly to consider the shutil.unpack sink? 😃
pwntester commentedon Jan 10, 2023
Yep, I think it would make sense to integrate this one into the tarslip one by creating a new source that includes all the cases you considered. So the new source would be either the creation of a new TarFile or a path coming from the sources you collected.
The problem here is that your source may be incomplete and therefore we may not report some issues. We could just report all calls to
unpack_archive()but such simple semantic query would not meet the acceptance criteria. We think that there is value in the source and taintsteps you wrote and therefore will accept it as an extension of the existing tarslip querySim4n6 commentedon Jan 10, 2023
Perfect, I will be working on that
pwntester commentedon Jan 18, 2023
Hi @Sim4n6 we have decided to accept the query as is since merging it with the existing one would be mixing sources and sinks that were not really meant to work together. There is nothing for you to do. Thanks for the contribution!
Sim4n6 commentedon Jan 18, 2023
Great thank you @pwntester I was going crazy with that... By the way, I have identified at least 03 CVEs with the query.
ghsecuritylab commentedon Jan 18, 2023
Your submission is now in status Test run.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
Sim4n6 commentedon Feb 2, 2023
Hi @pwntester,
I'm getting more potential CVEs assigned with the modified version of the query, and I would like to consider the sinks and the sources (as additional steps) from the TarSlip into the UnsafeUnpack query. It would look to me much more as modeling a whole and a viable attack from a RemoteFlowSource to an unsafe extraction. May the new query be considered for a higher bounty in that case, please? or do you suggest that I constrain the UnpackUnsafe for the sink
shutil.unpack_archive()and apply for the bug slayer program, next?Please, how do you suggest that I proceed?
pwntester commentedon Feb 2, 2023
Hi @Sim4n6,
That would increase the Scope of the query for sure. However, the scope is not the only element considered for the bounty level so I cant assure you that a higher scope level will transform into a higher bounty level. I encourage you to do so and at the same time, submit for the Bug Slayer program if you meet the criteria
Sim4n6 commentedon Feb 2, 2023
No problem, I will add the TarSlip sinks&sources to the UnsafeUnpack query. And latter apply for the Bug slayer. Thanks
ghsecuritylab commentedon Feb 21, 2023
Your submission is now in status Query review.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
ghsecuritylab commentedon Feb 24, 2023
Your submission is now in status Final decision.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
Sim4n6 commentedon Mar 3, 2023
So what is the final ruling on the matter, please?
ghsecuritylab commentedon Mar 9, 2023
Your submission is now in status Pay.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
xcorail commentedon Mar 9, 2023
Created Hackerone report 1898441 for bounty 463052 : [719] [Python] Unsafe unpacking using shutil.unpack_archive() query and tests
ghsecuritylab commentedon Mar 9, 2023
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed