Skip to content

Commit 0ec90d9

Browse files
esiebomajesiebomaj
committed
added potential vulnerability cases for python-sh in deliberately_vulnerable_flask_app
1 parent 57e27b4 commit 0ec90d9

File tree

3 files changed

+119
-5
lines changed

3 files changed

+119
-5
lines changed

‎documentation/deliberately_vulnerable_flask_app/app.py

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import requests
1111
from flask import Flask, render_template
1212
from lxml import etree
13+
import sh.sh as sh
1314

1415
app = Flask(__name__)
1516

@@ -57,3 +58,28 @@ def definite_ssrf(payload: str) -> None:
5758
@app.route("/xxe/<string:payload>")
5859
def definite_xxe(payload: str) -> None:
5960
etree.fromstring(payload)
61+
62+
63+
@app.route("/rce/<string:payload>") # picked
64+
def potential_rce_3(payload: str) -> None:
65+
sh.Command(path=payload, search_paths=[payload])
66+
67+
68+
@app.route("/rce/<string:payload>") # picked
69+
def potential_rce_4(payload: str) -> None:
70+
sh.RunningCommand(payload, call_args=[payload])
71+
72+
73+
@app.route("/rce/<string:payload>") # picked
74+
def potential_rce_5(payload: str) -> None:
75+
sh.OProc(command=payload, cmd=[payload])
76+
77+
78+
@app.route("/rce/<string:payload>") # picked
79+
def potential_rce_6(payload: str) -> None:
80+
sh.which(payload, paths=[payload])
81+
82+
83+
@app.route("/rce/<string:payload>")
84+
def potential_rce_7(payload: str) -> None:
85+
sh.ls(payload, payload)

‎documentation/deliberately_vulnerable_flask_app/full_result.json

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,5 +102,93 @@
102102
"path": "app.py",
103103
"stop_column": 36,
104104
"stop_line": 28
105+
},
106+
{
107+
"line": 65,
108+
"column": 20,
109+
"stop_line": 65,
110+
"stop_column": 27,
111+
"path": "app.py",
112+
"code": 6065,
113+
"name": "Commandline arguments injection may result in RCE",
114+
"description": "Commandline arguments injection may result in RCE [6065]: Data from [UserControlled] source(s) may reach [ExecArgSink] sink(s)",
115+
"define": "app.potential_rce_3"
116+
},
117+
{
118+
"line": 65,
119+
"column": 42,
120+
"stop_line": 65,
121+
"stop_column": 51,
122+
"path": "app.py",
123+
"code": 6065,
124+
"name": "Commandline arguments injection may result in RCE",
125+
"description": "Commandline arguments injection may result in RCE [6065]: Data from [UserControlled] source(s) may reach [ExecArgSink] sink(s)",
126+
"define": "app.potential_rce_3"
127+
},
128+
{
129+
"line": 70,
130+
"column": 41,
131+
"stop_line": 70,
132+
"stop_column": 50,
133+
"path": "app.py",
134+
"code": 6065,
135+
"name": "Commandline arguments injection may result in RCE",
136+
"description": "Commandline arguments injection may result in RCE [6065]: Data from [UserControlled] source(s) may reach [ExecArgSink] sink(s)",
137+
"define": "app.potential_rce_4"
138+
},
139+
{
140+
"line": 70,
141+
"column": 22,
142+
"stop_line": 70,
143+
"stop_column": 29,
144+
"path": "app.py",
145+
"code": 6065,
146+
"name": "Commandline arguments injection may result in RCE",
147+
"description": "Commandline arguments injection may result in RCE [6065]: Data from [UserControlled] source(s) may reach [ExecArgSink] sink(s)",
148+
"define": "app.potential_rce_4"
149+
},
150+
{
151+
"line": 75,
152+
"column": 21,
153+
"stop_line": 75,
154+
"stop_column": 28,
155+
"path": "app.py",
156+
"code": 6065,
157+
"name": "Commandline arguments injection may result in RCE",
158+
"description": "Commandline arguments injection may result in RCE [6065]: Data from [UserControlled] source(s) may reach [ExecArgSink] sink(s)",
159+
"define": "app.potential_rce_5"
160+
},
161+
{
162+
"line": 75,
163+
"column": 34,
164+
"stop_line": 75,
165+
"stop_column": 43,
166+
"path": "app.py",
167+
"code": 6065,
168+
"name": "Commandline arguments injection may result in RCE",
169+
"description": "Commandline arguments injection may result in RCE [6065]: Data from [UserControlled] source(s) may reach [ExecArgSink] sink(s)",
170+
"define": "app.potential_rce_5"
171+
},
172+
{
173+
"line": 80,
174+
"column": 13,
175+
"stop_line": 80,
176+
"stop_column": 20,
177+
"path": "app.py",
178+
"code": 6065,
179+
"name": "Commandline arguments injection may result in RCE",
180+
"description": "Commandline arguments injection may result in RCE [6065]: Data from [UserControlled] source(s) may reach [ExecArgSink] sink(s)",
181+
"define": "app.potential_rce_6"
182+
},
183+
{
184+
"line": 80,
185+
"column": 28,
186+
"stop_line": 80,
187+
"stop_column": 37,
188+
"path": "app.py",
189+
"code": 6065,
190+
"name": "Commandline arguments injection may result in RCE",
191+
"description": "Commandline arguments injection may result in RCE [6065]: Data from [UserControlled] source(s) may reach [ExecArgSink] sink(s)",
192+
"define": "app.potential_rce_6"
105193
}
106194
]

‎stubs/third_party_taint/pythonsh_sinks.pysa

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
def sh.which(program: TaintSink[RemoteCodeExecution], paths: TaintSink[RemoteCodeExecution]):...
2-
def sh.command.__init__(self, path: TaintSink[RemoteCodeExecution], search_paths: TaintSink[RemoteCodeExecution]):...
3-
def sh.RunningCommand.__init__(self, cmd:TaintSink[RemoteCodeExecution], call_args:TaintSink[RemoteCodeExecution], stdin, stdout, stderr)
4-
def sh.oproc.__init__(self, command:TaintSink[RemoteCodeExecution], parent_log, cmd:TaintSink[RemoteCodeExecution], stdin, stdout, stderr, call_args:TaintSink[RemoteCodeExecution], pipe, process_assign_lock)
5-
def sh.SelfWrapper.__init__(self, self_module: TaintSink[RemoteCodeExecution], baked_arg: TaintSink[RemoteCodeExecution])
1+
def sh.sh.command.__init__(self, path:TaintSink[ExecArgSink], search_paths:TaintSink[ExecArgSink]):...
2+
def sh.sh.RunningCommand.__init__(self, cmd:TaintSink[ExecArgSink], call_args:TaintSink[ExecArgSink], stdin, stdout, stderr):...
3+
def sh.sh.OProc.__init__(self, command:TaintSink[ExecArgSink], parent_log, cmd:TaintSink[ExecArgSink], stdin, stdout, stderr, call_args:TaintSink[ExecArgSink], pipe, process_assign_lock):...
4+
def sh.sh.which(program:TaintSink[ExecArgSink], paths:TaintSink[ExecArgSink]):...
5+
def sh.sh.SelfWrapper.__init__(self, self_module:TaintSink[ExecArgSink], baked_arg:TaintSink[ExecArgSink]):...

0 commit comments

Comments
 (0)