[Security] Critical: Unsafe eval() Usage - Remote Code Execution Vulnerability
- Dominant language
- Python
- Stars
- 2k
- Forks
- 984
- Avg merge
- 2h 54m
- Merged PRs (30d)
- 14
Description
## Summary
Multiple instances of dangerous `eval()` calls throughout the codebase can execute arbitrary Python code, creating a **critical remote code execution vulnerability (CWE-95)**.
## Severity
🔴 **Critical** - This vulnerability could allow attackers to execute arbitrary code on the server.
## Affected Files
- `apps/challenges/aws_utils.py` (6 instances)
- `apps/challenges/views.py` (1 instance)
- `scripts/workers/submission_worker.py` (2 instances)
## Vulnerability Details
### 1. In `aws_utils.py` (Line ~288, 356, 404, 439, 1069, 1090)
```python
definition = eval(definition) # Dangerous!
kwargs = eval(kwargs) # Dangerous!
```
### 2. In `views.py` (Line ~3086)
```python
users_email = eval(users_email) # User input directly evaluated!
```
### 3. In `submission_worker.py` (Line ~895, 929)
```python
if eval(LIMIT_CONCURRENT_SUBMISSION_PROCESSING): # Dangerous!
```
## Security Impact
- **Attack Vector**: Attackers can inject malicious Python code through API parameters
- **Potential Damage**:
- Remote code execution on server
- Data exfiltration
- Server compromise
- Privilege escalation
## Proof of Concept
An attacker could send malicious input like:
```python
"__import__('os').system('malicious_command')"
```
## Recommended Fix
Replace all `eval()` calls with safe alternatives:
- Use `json.loads()` for parsing JSON strings
- Use `ast.literal_eval()` for Python literals
- For boolean strings, use explicit string comparison
Example:
```python
# Instead of:
data = eval(string_data)
# Use:
import json
data = json.loads(string_data)
```
Contributor guide
Research direction
Start by reviewing the listed eval() calls in apps/challenges/aws_utils.py, apps/challenges/views.py, and scripts/workers/submission_worker.py, including the surrounding input handling. Determine the appropriate safe parsing behavior for each call, then verify that the affected challenge, API, and submission-worker paths no longer evaluate attacker-controlled code.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100