Skip to content

Hardening suggestions for insecure-kubernetes-deployments / empty #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pixeebot wants to merge 5 commits into from
Closed

Hardening suggestions for insecure-kubernetes-deployments / empty #62

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
476193e
Add timeout to `requests` calls
pixeebot[bot] Nov 22, 2024
2b1a8c7
Use Safe Parsers in `lxml` Parsing Functions
pixeebot[bot] Nov 22, 2024
c1e6d5b
Sandbox URL Creation
pixeebot[bot] Nov 22, 2024
044130a
Sandbox Process Creation
pixeebot[bot] Nov 22, 2024
9791ab7
Use Safe Defaults for `lxml` Parsers
pixeebot[bot] Nov 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions insecure-app/app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,9 @@
import subprocess
import os
import sqlite3
import requests
from lxml import etree
import lxml.etree
Copy link

@jit-ci jit-ci bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Static Code Analysis Python Semgrep

Type: Potential Xxe Vulnerability With Native Python Xml Libraries

Description: Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
attacks. The Python documentation recommends the 'defusedxml' library instead. Use 'defusedxml'.
See https://github.com/tiran/defusedxml for more information.

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_ignore_type_in_file Ignore any finding of type "Potential XXE vulnerability with native Python XML libraries" in insecure-app/app.py; future occurrences will also be ignored.
  • #jit_undo_ignore Undo ignore command

from security import safe_command, safe_requests

# Example hardcoded AWS credentials (sensitive data leakage)
aws_access_key_id = 'AKIA2JAPX77RGLB664VE'
Expand All @@ -28,7 +29,7 @@ def index():
# 2 - Command Injection
if 'command' in request.form:
cmd = request.form['command']
process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
process = safe_command.run(subprocess.Popen, cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
Copy link
Author

@pixeebot pixeebot bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Replaces subprocess.{func} with more secure safe_command library functions.

stdout, stderr = process.communicate()
if process.returncode == 0:
output = stdout.decode('utf-8')
Expand Down Expand Up @@ -67,8 +68,8 @@ def index():
xml_data = request.form['xml']
try:
# Use lxml to parse the XML data
parser = etree.XMLParser(load_dtd=True, resolve_entities=True)
tree = etree.fromstring(xml_data.encode(), parser)
parser = etree.XMLParser(load_dtd=True, resolve_entities=False)
Copy link
Author

@pixeebot pixeebot bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call lxml.etree.parse and lxml.etree.fromstring with a safe parser.

Copy link
Author

@pixeebot pixeebot bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Replace lxml parser parameters with safe defaults.

tree = etree.fromstring(xml_data.encode(), parser, parser=lxml.etree.XMLParser(resolve_entities=False))
Copy link

@jit-ci jit-ci bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Static Code Analysis Python Semgrep

Type: Potential Xxe Vulnerability With Native Python Xml Libraries

Description: Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
attacks. The Python documentation recommends the 'defusedxml' library instead. Use 'defusedxml'.
See https://github.com/tiran/defusedxml for more information.

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_ignore_type_in_file Ignore any finding of type "Potential XXE vulnerability with native Python XML libraries" in insecure-app/app.py; future occurrences will also be ignored.
  • #jit_undo_ignore Undo ignore command

output = f"Parsed XML: {etree.tostring(tree, encoding='unicode')}"
except Exception as e:
output = f"XML Parsing Error: {e}"
Expand All @@ -77,7 +78,7 @@ def index():
elif 'url' in request.form:
url = request.form['url']
try:
Copy link
Author

@pixeebot pixeebot bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add timeout to requests call

response = requests.get(url)
response = safe_requests.get(url, timeout=60)
Copy link
Author

@pixeebot pixeebot bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switch use of requests for security.safe_requests

output = f"SSRF Response: {response.text[:200]}"
except Exception as e:
output = f"SSRF Error: {e}"
Expand Down
4 changes: 2 additions & 2 deletions insecure-app/ransomware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ def __init__(self):
self.localRoot = r'D:\Coding\Python\RansomWare\RansomWare_Software\localRoot' # Debugging/Testing

# Get public IP of person, for more analysis etc. (Check if you have hit gov, military ip space LOL)
self.publicIP = requests.get('https://api.ipify.org').text
self.publicIP = requests.get('https://api.ipify.org', timeout=60).text
Copy link
Author

@pixeebot pixeebot bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add timeout to requests call



# Generates [SYMMETRIC KEY] on victim machine which is used to encrypt the victims data
Expand Down Expand Up @@ -254,4 +254,4 @@ def main():


if __name__ == '__main__':
main()
main()
3 changes: 2 additions & 1 deletion insecure-app/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
requests == 2.19.1
cryptography==3.3.2
flask==3.0.2
#cryptograpy==3.3.2
#cryptograpy==3.3.2
security==1.3.1
Copy link
Author

@pixeebot pixeebot bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Python API calls.

License: MIT ✅ Open Source ✅ More facts

2 changes: 1 addition & 1 deletion llm-testing/llm-testing.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
def query(payload, model_id, api_token):
headers = {"Authorization": f"Bearer {api_token}"}
API_URL = f"https://api-inference.huggingface.co/models/{model_id}"
response = requests.post(API_URL, headers=headers, json={"inputs": payload})
response = requests.post(API_URL, headers=headers, json={"inputs": payload}, timeout=60)
Copy link
Author

@pixeebot pixeebot bot Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add timeout to requests call

response_text = response.text

sanitized_response_text, results_valid, results_score = scan_output(
Expand Down
Loading