Thanks to visit codestin.com
Credit goes to github.com

Skip to content

gh-97612: Fix shell injection in get-remote-certificate.py #97613

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 28, 2022
Merged

gh-97612: Fix shell injection in get-remote-certificate.py #97613

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions Misc/NEWS.d/next/Security/2022-09-28-12-10-57.gh-issue-97612.y6NvOQ.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Fix a shell code injection vulnerability in the ``get-remote-certificate.py``
example script. The script no longer uses a shell to run ``openssl`` commands.
Issue reported and initial fix by Caleb Shortt. Patch by Victor Stinner.
25 changes: 7 additions & 18 deletions Tools/scripts/get-remote-certificate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@
def fetch_server_certificate (host, port):

def subproc(cmd):
from subprocess import Popen, PIPE, STDOUT
proc = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True)
from subprocess import Popen, PIPE, STDOUT, DEVNULL
proc = Popen(cmd, stdout=PIPE, stderr=STDOUT, stdin=DEVNULL)
status = proc.wait()
output = proc.stdout.read()
return status, output
Expand All @@ -33,8 +33,8 @@ def strip_to_x509_cert(certfile_contents, outfile=None):
fp.write(m.group(1) + b"\n")
try:
tn2 = (outfile or tempfile.mktemp())
status, output = subproc(r'openssl x509 -in "%s" -out "%s"' %
(tn, tn2))
cmd = ['openssl', 'x509', '-in', tn, '-out', tn2]
status, output = subproc(cmd)
if status != 0:
raise RuntimeError('OpenSSL x509 failed with status %s and '
'output: %r' % (status, output))
Expand All @@ -45,20 +45,9 @@ def strip_to_x509_cert(certfile_contents, outfile=None):
finally:
os.unlink(tn)

if sys.platform.startswith("win"):
tfile = tempfile.mktemp()
with open(tfile, "w") as fp:
fp.write("quit\n")
try:
status, output = subproc(
'openssl s_client -connect "%s:%s" -showcerts < "%s"' %
(host, port, tfile))
finally:
os.unlink(tfile)
else:
status, output = subproc(
'openssl s_client -connect "%s:%s" -showcerts < /dev/null' %
(host, port))
cmd = ['openssl', 's_client', '-connect', '%s:%s' % (host, port), '-showcerts']
status, output = subproc(cmd)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

on windows stdin was hooked up to a file containing "quit\n". was that necessary? If so, use your added subproc stdin= support from above to do that. otherwise, get rid of the added subprob stdin= support to make this PR smaller.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, I removed the now unused stdin parameter.

This script is used to connect to a HTTPS server. Saying "quit\n" to a HTTP server makes no sense to me. Maybe on Windows, previously the command was blocked until the user wrotes something and then press ENTER? But with this change, the stdin is replaced with DEVNULL (NUL device on Windows) and so it should no longer block.

First, I basically rewrote the whole script. I don't get half of the code. For example, it runs the "x509" to get the same output than the input... it doesn't make any sense to me. But I tried to keep this change as small as possible...

Then I think that we should just remove the script in the main branch :-)

My main motivation for this change is to prevent users to report the same issue later, even if the impact of the vulnerability is basically non existent since I don't imagine that anyone runs such script on a production server with inputs taken from the Internet...

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In that case, I'd take the current report as reason to remove the script from main, and the next report as reason to remove it from other branches. Or just go ahead and remove it everywhere. It's not worth fixing.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the fix is straightforward, I prefer first to fix the script in all branches.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I created https://discuss.python.org/t/remove-outdated-tools-scripts-scripts/19571 discussion to propose removing outdated example scripts.


if status != 0:
raise RuntimeError('OpenSSL connect failed with status %s and '
'output: %r' % (status, output))
Expand Down