26

This question is similar to Exploitable PHP Functions.

Tainted data comes from the user, or more specifically an attacker. When a tainted variable reaches a sink function, then you have a vulnerability. For instance a function that executes a sql query is a sink, and GET/POST variables are sources of taint.

What are all of the sink functions in Python? I am looking for functions that introduce a vulnerability or software weakness. I am particularly interested in Remote Code Execution vulnerabilities. Are there whole classes/modules that contain dangerous functionally? Do you have any examples of interesting Python vulnerabilities?

6
  • 6
    How about making this a community wiki? Commented Nov 17, 2010 at 17:56
  • @Sven Marnach how would that make this better? I haven't done that before.
    – rook
    Commented Nov 17, 2010 at 18:03
  • It is (would be?) very difficult to secure Python to any great degree; the language is simply too flexible for that. If you're trying to create a secure Python environment, you have a very large task ahead of you.
    – Katriel
    Commented Nov 17, 2010 at 18:20
  • 2
    @Rook: It would enable people to collaboratively compile the list. The accepted answer of the PHP post you linked is also a community wiki post. Commented Nov 17, 2010 at 20:25
  • 1
    @Sven Marnach your more than welcome to edit my post for this thread. I had some help with the PHP list and that worked out.
    – rook
    Commented Nov 17, 2010 at 21:11

5 Answers 5

14

right from the pickle documentation:

Warning

The pickle module is not intended to be secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.
1
  • 1
    Pickled data is on of the worst, since it's not structured or readable enough to sanitise, and arbitrary code can be executed while unpickling. For example, sending pickled data structures over DBUS (or some other open-ish IPC mechanism) can be a massive security hole, but this is not necessarily obvious to someone new to Python or DBUS. A better approach is to write an explicit serialisation method, using JSON or XML, and send THAT over whatever protocol you're using.
    – detly
    Commented Nov 27, 2010 at 7:04
14

eval and exec are the classics. However, open and file can be abused too:

open('/proc/kcore', 'w').write('0' * 1000 * 1000 * 1000)

Then there are the os, sys, subprocess, and dircache modules. Pretty much anything that touches the filesystem or can be used to turn data into executable code (like os.system) is going to be on the list.

As S. Lott pointed out in the comments, writing to the filesystem and executing arbitrary external programs aren't Python-specific. However, they are worth security auditors' consideration. Most of these functions can be safely used without too much concern for security. eval and exec, on the other hand, are great big red flags. Using them safely requires meticulous care.

4
  • 2
    Opening '/proc/kcore' requires privileges that most processes don't have. This is a different kind of exploit because it requires privileges and isn't just shabby coding.
    – S.Lott
    Commented Nov 17, 2010 at 18:21
  • 2
    @S.Lott: Sure, but that was just a (dramatic) example. Maybe an attacker expects to be running as the web server user and opens /var/www/index.html instead. Good security is layered. We can't expect all our users' administrators to ensure that everything runs with optimal permissions all the time, so it's worth paying a little extra attention and looking for this sort of thing.
    – nmichaels
    Commented Nov 17, 2010 at 18:43
  • "Good security is layered". That's not entirely the point. The eval and exec are Python exploits that don't rely on security. The other exploit is different in kind -- it's irrelevant to Python, since all languages have it. It's part of OS privilege management. If you're going to list that, then you have to start listing all OS exploits that have nothing to do with Python. I think you should segregate this more clearly in your answer as a different kind of exploit that only happens to use Python.
    – S.Lott
    Commented Nov 17, 2010 at 19:46
  • @S.Lott: Fair enough. Better?
    – nmichaels
    Commented Nov 17, 2010 at 20:30
10
+50

I tend toward the paranoid when looking for this kind of thing. More so because I tend to do alot of metaprogramming.

  • most side effect commands (which other posts cover)
    • file manipulation (open, tarfile, zipfile, ...)
    • network calls (urllib2, socket, ...)
    • data serialization/persistence (pickle, shelve, ...)
    • process/thread management (subprocess, os.fork, os.kill, ...)
  • builtins
    • getattr
    • setattr
    • delattr
    • eval
    • exec
    • execfile
    • __import__

And probably others I'm forgetting. I'm also wary of user input going through functions where I'm modifying sys.path, sys.modules, etc.

6

The subprocess module contains nasty functionally which deprecated these ways of executing commands/processes:

os.system
os.spawn*
os.popen*
popen2.*
commands.*

There is also exec which will execute python code and eval which will "evaluate" an expression and can be used to manipulate variables.

3

The input function, which evaluates the given string and returns the result, has some restrictions, but still may be exploitable.

2
  • Can confirm that it is exploitable. __import__('os').system('ls') Feeding in the above string in stdin, results in execution of ls command in shell.
    – gtux
    Commented Sep 4, 2017 at 13:07
  • How exacly input function evaluates the given string? Commented Dec 13, 2020 at 17:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.