4 ms·
Nice find, I commented on your blog a method you can use to extend this vulnerability into RCE without admin interactivity.
by netsec_burn 9y ago
Nice find, I commented on your blog a method you can use to extend this vulnerability into RCE without admin interactivity.
- gruez 9y ago>Upload a .py file to the untrusted directory that has the same name of one of the imports used in the Python script. It will be executed the next time Python is called by the script, so you don't need to wait for interactivity on the admins part I have a feeling that only works on python2 because of absolute imports on python3.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- gcr 9y agoUpload a script that replaces the old file source and wait for gunicorn or whatever to reload the app server.
- gehaxelt 9y agoThe script seems to ship with a rundimentary webserver by default, so I don't see a reason to wrap gunicorn et al. around it? However, you're right that overwriting the source is a possible attack vector.
- internetwache 9y agoHi, thanks for commenting! I had cronjobs in mind, but as you said, they are not writeable. I also thought about uploading a .py file with an import's name, but wouldn't that require a __init__.py (in a subdirectory?) to be regarded as a valid module/import by python?