blob: a38b4c02dd07711af57c01b5cc450346ada8db7e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
---
stage: Secure
group: Dynamic Analysis
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
---
# Server-side code injection (Python)
## Description
The target application was found vulnerable to code injection. A malicious actor could inject arbitrary
Python code to be executed on the server. This could lead to a full system compromise by accessing
stored secrets, injecting code to take over accounts, or executing OS commands.
## Remediation
Never pass user input directly into functions which evaluate string data as code, such as `eval`,
or `exec`. There is almost no benefit of passing string values to these methods, as such the best
recommendation is to replace the current logic with more safe implementations of dynamically evaluating
logic with user input. One alternative is to store functions or methods in a hashmap that can be looked
up using a key. If the key exists, the function can be executed.
```python
def func_to_run():
print('hello world')
function_map = {'fn': func_to_run}
input = 'fn'
if input in function_map:
function_map[input]()
else:
print('invalid input')
```
## Details
| ID | Aggregated | CWE | Type | Risk |
|:---|:--------|:--------|:--------|:--------|
| 94.3 | false | 94 | Active | high |
## Links
- [CWE](https://cwe.mitre.org/data/definitions/94.html)
|
