New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[<Python>]: <Add shutil module sinks for path injection query> #518

Closed

1 of 2 tasks

haby0 opened this issue Jan 7, 2022 · 8 comments

Closed

1 of 2 tasks

[<Python>]: <Add shutil module sinks for path injection query> #518

haby0 opened this issue Jan 7, 2022 · 8 comments

Labels

haby0 commented Jan 7, 2022 •

edited

Query PR

github/codeql#7455

Language

Python

CVE(s) ID list

CVE-2022-22821

CWE

CWE-022

Report

1.What is the vulnerability?
Path injection of shutil module.

2.How does the vulnerability work?
If the path is controlled by some function calls of the shutil module, it may cause malicious attacks. For example, the rmtree function will delete the specified directory. The move function will move the specified file or move the specified file to the specified location, causing the file content to leak.

3.What strategy do you use in your query to find the vulnerability?
The remote input controllable path variables are not filtered, and are directly processed by the path operation function under the shutil module.

4.What have you reduced the number of false positives?
Sanitizer has not been modeled yet.

5.Other information?
None.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

Yes
No

Blog post link

No response

haby0 added the All For One label

Collaborator

ghsecuritylab commented Jan 17, 2022

Your submission is now in status Test run.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

Author

haby0 commented Jan 25, 2022

github/codeql#7455 this PR has been merged.

Collaborator

ghsecuritylab commented Jan 25, 2022

Your submission is now in status Results analysis.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

Collaborator

ghsecuritylab commented Jan 31, 2022

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

Collaborator

ghsecuritylab commented Feb 1, 2022

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

Collaborator

ghsecuritylab commented Feb 4, 2022

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

Contributor

xcorail commented Feb 4, 2022

Created Hackerone report 1471622 for bounty 366791 : [518] [Python]: Add shutil module sinks for path injection query

xcorail closed this as completed

Collaborator

ghsecuritylab commented Feb 4, 2022

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment