Skip to content

Hardening suggestions for insecure-kubernetes-deployments / pixeebot/drip-2024-12-19-pixee-python/add-requests-timeouts #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

Hardening suggestions for insecure-kubernetes-deployments / pixeebot/drip-2024-12-19-pixee-python/add-requests-timeouts #68

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
69be838
Sandbox Process Creation
pixeebot[bot] Dec 19, 2024
6f3b712
Sandbox URL Creation
pixeebot[bot] Dec 19, 2024
40d9299
Use Safe Defaults for `lxml` Parsers
pixeebot[bot] Dec 19, 2024
2e95556
Use Safe Parsers in `lxml` Parsing Functions
pixeebot[bot] Dec 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion insecure-api/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
fastapi==0.115.5
uvicorn==0.32.1
uvicorn==0.32.1
security==1.3.1
Copy link

@arnica-github-connector arnica-github-connector bot Dec 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reputation Risk: [email protected] has a low reputation score

The package has a low reputation score, consider finding an alternative.
Score factors:

  • Low # of releases: 5
  • Low # of dependents: 2
  • Low # of recent downloads: 3,428
  • Low # of stars: 14

Severity: Medium ⚠️
Status: Open 🔴

Resources:

  1. How to Find Alternative Packages to Low-Reputation Open Source Packages?
  2. Identifying Low Reputation Packages: Key Factors and Their Importance
  3. What is OpenSSF Scorecard?

Take action by replying with an [arnica] command 💬

Actions

Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.

[arnica] ack <message>

Acknowledge the finding as a valid code risk.

Examples

[arnica] ack looking into it


[a] ack triaged by the security team

[arnica] dismiss <fp|accept|capacity> <message>

Dismiss the risk with a reason.

  • fp: False positive, i.e. the result is incorrect and indicates no actual risk.

  • accept: Tolerable risk, i.e. risk severity is lower than what has been reported or is accepted as it stands.

  • capacity: No capacity, i.e. leave me alone, please.

Examples

[arnica] dismiss fp test function


[arnica] dismiss accept ChatGPT assures us that we will be just fine


[a] dismiss capacity not enough caffeine to fix it

11 changes: 6 additions & 5 deletions insecure-app/app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,9 @@
import subprocess
import os
import sqlite3
import requests
from lxml import etree
from security import safe_requests, safe_command
import lxml.etree
Copy link

@jit-ci jit-ci bot Dec 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Static Code Analysis Python Semgrep

Potential Xxe Vulnerability With Native Python Xml Libraries

Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
attacks. The Python documentation recommends the 'defusedxml' library instead. Use 'defusedxml'.
See https://github.com/tiran/defusedxml for more information.

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_ignore_type_in_file Ignore any finding of type "Potential XXE vulnerability with native Python XML libraries" in insecure-app/app.py; future occurrences will also be ignored.
  • #jit_undo_ignore Undo ignore command


# Example hardcoded AWS credentials (sensitive data leakage)
aws_access_key_id = 'AKIA2JAPX77RGLB664VE'
Expand All @@ -28,7 +29,7 @@ def index():
# 2 - Command Injection
if 'command' in request.form:
cmd = request.form['command']
process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
process = safe_command.run(subprocess.Popen, cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
stdout, stderr = process.communicate()
if process.returncode == 0:
output = stdout.decode('utf-8')
Expand Down Expand Up @@ -67,8 +68,8 @@ def index():
xml_data = request.form['xml']
try:
# Use lxml to parse the XML data
parser = etree.XMLParser(load_dtd=True, resolve_entities=True)
tree = etree.fromstring(xml_data.encode(), parser)
parser = etree.XMLParser(load_dtd=True, resolve_entities=False)
tree = etree.fromstring(xml_data.encode(), parser, parser=lxml.etree.XMLParser(resolve_entities=False))
Copy link

@jit-ci jit-ci bot Dec 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Static Code Analysis Python Semgrep

Potential Xxe Vulnerability With Native Python Xml Libraries

Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
attacks. The Python documentation recommends the 'defusedxml' library instead. Use 'defusedxml'.
See https://github.com/tiran/defusedxml for more information.

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_ignore_type_in_file Ignore any finding of type "Potential XXE vulnerability with native Python XML libraries" in insecure-app/app.py; future occurrences will also be ignored.
  • #jit_undo_ignore Undo ignore command

output = f"Parsed XML: {etree.tostring(tree, encoding='unicode')}"
except Exception as e:
output = f"XML Parsing Error: {e}"
Expand All @@ -77,7 +78,7 @@ def index():
elif 'url' in request.form:
url = request.form['url']
try:
response = requests.get(url, timeout=60)
response = safe_requests.get(url, timeout=60)
output = f"SSRF Response: {response.text[:200]}"
except Exception as e:
output = f"SSRF Error: {e}"
Expand Down
4 changes: 2 additions & 2 deletions insecure-app/ransomware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
import webbrowser # to load webbrowser to go to specific website eg bitcoin
import ctypes # so we can intereact with windows dlls and change windows background etc
import urllib.request # used for downloading and saving background image
import requests # used to make get reqeust to api.ipify.org to get target machine ip addr
import time # used to time.sleep interval for ransom note & check desktop to decrypt system/files
import datetime # to give time limit on ransom note
import subprocess # to create process for notepad and open ransom note
Expand All @@ -14,6 +13,7 @@
from Crypto.Cipher import AES, PKCS1_OAEP
import base64
import threading # used for ransom note and decryption key on dekstop
from security import safe_requests



Expand Down Expand Up @@ -50,7 +50,7 @@ def __init__(self):
self.localRoot = r'D:\Coding\Python\RansomWare\RansomWare_Software\localRoot' # Debugging/Testing

# Get public IP of person, for more analysis etc. (Check if you have hit gov, military ip space LOL)
self.publicIP = requests.get('https://api.ipify.org', timeout=60).text
self.publicIP = safe_requests.get('https://api.ipify.org', timeout=60).text


# Generates [SYMMETRIC KEY] on victim machine which is used to encrypt the victims data
Expand Down
3 changes: 2 additions & 1 deletion insecure-app/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
requests == 2.19.1
cryptography==3.3.2
flask==3.0.2
#cryptograpy==3.3.2
#cryptograpy==3.3.2
security==1.3.1
Loading