Remediation for this vulnerability basically caused complete gridlock for the internal tools at a certain FAANG company today.
Yip, everyone was paged last night, been in a bad way since. Got grief for commenting as much in thread.
Python 3.x: RCE in Python applications that accept floats as untrusted input
61–70 of 72 posts
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#62Extremely misleading title. This only affects code that puts untrusted floats into ctypes. An relatively very uncommon case. Please stop the clickbait!
Why the downvotes? CyberRabbi is correct. The title makes it sound like all programs that accept floats from untrusted input are vulnerable.
In my experience here I find that it’s not uncommon for correct statements to get downvoted more than incorrect ones.
Why? I think it’s because incorrect statements can be corrected in a reply. OTOH correct statements with which one disagrees or otherwise dislikes cannot be corrected but they can be downvoted.
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#63I'd be extremely impressed if someone actually managed to get RCE out of this, considering you'd only be able to use '0' through '9', or 0x30 through 0x39, in your payload.
If the float is part of an error message or logging message, the attacker may control portions of the string that appear after the float. This would let them inject a much larger range of bytes, perhaps even UTF-8.
It's not that powerful, if I'm reading it correctly: https://github.com/python/cpython/commit/34df10a9a16b38d5442...
The sprintf is to a temporary buffer that's converted to a PyUnicode object before returning, so subsequent portions of the string are written elsewhere.
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#64I'd be extremely impressed if someone actually managed to get RCE out of this, considering you'd only be able to use '0' through '9', or 0x30 through 0x39, in your payload.
Hey! Original discoverer here. I would like to clarify some things. It would certainly be possible given that we can have numeric shell-code (check the reference). The real problem in here is the security mechanisms like stack cookies, brute-forcing those would have been a PITA with only numbers. But I'd have to take a closer look at the stack god knows what GCC could have done there :)
On a system without these protection mechanisms it would be a easy win.
Reference: https://haxx.in/posts/numeric-shellcode/
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#65Already fixed in Python 3.6, 3.7, 3.8 and 3.9: https://bugs.python.org/issue42938 3.6.13 and 3.7.10 have already been released with the fix: https://www.python.org/downloads/release/python-3613/ https://www.python.org/downloads/release/python-3710/ The 3.8.8 and 3.9.2 release candidates with the fix will be promoted on Monday March 1st: https://discuss.python.org/t/python-3-9-2rc1-and-3-8-8rc1-ar... If you're on 3.5…
Update: 3.8.8 and 3.9.2 have been released. https://discuss.python.org/t/python-3-9-2-and-3-8-8-are-now-...
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#66I'd be extremely impressed if someone actually managed to get RCE out of this, considering you'd only be able to use '0' through '9', or 0x30 through 0x39, in your payload.
It sounds like an extreme minimal instruction set computer (MISC), and it's surprising how much is possible with even just one or two opcodes - that can easily be Turing-complete
Semi-related: I discovered that you can divert control flow to an arbitrary point on the TI MSP430 using only the bytes in ascii alphanumeric range.
https://docs.google.com/presentation/d/19K7SK1L49reoFgjEPKCF...
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#67I'd be extremely impressed if someone actually managed to get RCE out of this, considering you'd only be able to use '0' through '9', or 0x30 through 0x39, in your payload.
Hey! Original discoverer here. I would like to clarify some things. It would certainly be possible given that we can have numeric shell-code (check the reference). The real problem in here is the security mechanisms like stack cookies, brute-forcing those would have been a PITA with only numbers. But I'd have to take a closer look at the stack god knows what GCC could have done there :) On a system without these prot…
Wow that's very impressive.
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#68Earlier quoted context omitted.
Why the downvotes? CyberRabbi is correct. The title makes it sound like all programs that accept floats from untrusted input are vulnerable.
In my experience here I find that it’s not uncommon for correct statements to get downvoted more than incorrect ones. Why? I think it’s because incorrect statements can be corrected in a reply. OTOH correct statements with which one disagrees or otherwise dislikes cannot be corrected but they can be downvoted.
Because moaning about clickbait is really boring, often correlated with people being surprised because they didn't read the article first, and once again not very useful if you read the article.
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#69Earlier quoted context omitted.
In my experience here I find that it’s not uncommon for correct statements to get downvoted more than incorrect ones. Why? I think it’s because incorrect statements can be corrected in a reply. OTOH correct statements with which one disagrees or otherwise dislikes cannot be corrected but they can be downvoted.
Because moaning about clickbait is really boring, often correlated with people being surprised because they didn't read the article first, and once again not very useful if you read the article.
I read the article, actually I read it in a concerned state, and then I realized there was little need for concern. Clickbait is a daily problem on this site, there’s no need to insult or attack my character for raising the issue.
Re: Python 3.x: RCE in Python applications that accept floats as untrusted input
#70Earlier quoted context omitted.
Because moaning about clickbait is really boring, often correlated with people being surprised because they didn't read the article first, and once again not very useful if you read the article.
I read the article, actually I read it in a concerned state, and then I realized there was little need for concern. Clickbait is a daily problem on this site, there’s no need to insult or attack my character for raising the issue.
What I said has nothing to do with your character. Besides, I recognize your name so know you aren't dumb