3 ms·
Surely this is only a security risk if antigravity is imported? What cause would there be to import antigravity in a CGI service – or anything other than a ter
by dpwm 5y ago
Surely this is only a security risk if antigravity is imported?
What cause would there be to import antigravity in a CGI service – or anything other than a terminal in which you could already execute arbitrary code?
I am struggling to understand, even with the proof of concept, how the situation could arise where an attacker could realistically exploit this, based largely on the uselessness of the antigravity module.
- jvanderbot 5y agoI left one window open, but what is to guarantee a burgler would use that window??
- dpwm 5y agoAbsolutely, I agree now that I see it, and these seem like numerous innocent-seeming footguns just waiting for abuse. Add the not-too-far-fetched-seeming assumption that it’s fine to let the Internet define your environment variables, and it’s a plausible exploit. This is why, as another commenter points out, defense in depth is so important.
- geofft 5y agoSee the "Making Progress With PYTHONWARNINGS" section in the article posted - setting the environment variable PYTHONWARNINGS to a value mentioning the antigravity module causes it to be imported, even if there's no "import antigravity" statement in the actual source.
- dpwm 5y agoNot sure how I missed that – it was even in the proof of concept in the message I replied to. Thanks for the help. There are multiple failings that don’t seem like a big deal taken in isolation: - The PYTHONWARNINGS and whole Warning Filters system. - The webbrowser module executing a given executable from an environment variable. - The antigravity module running webbrowser.open() on import. All of these sort of seem a bit like sacrificing good taste for convenience. But in combination, in a situation where you don’t control the environment variables, they do lead to arbitrary code execution. In other words, it’s not all antigravity’s fault, but those side effects on import make this possible.
- kzrdude 5y agoYou're right about sacrificing good taste for convenience, but since this is an easter egg, it's sacrificing good taste for a laugh, and I think that pushes it over the precipe over into being a bad idea.