«(Без)опасный Python», Иван Цыганов, Positive Technologies
•
1 like•152 views
The document discusses various security vulnerabilities in Python web applications. It begins with an overview of the OWASP Top 10 security risks, with sections focusing on risks related to using components with known vulnerabilities (A9) and insufficient attack protection (A7). For A9, it provides examples of vulnerabilities in popular Python packages and recommends checking changelogs and vulnerability databases. For A7, it recommends implementing attack protections like login attempts logging, rate limiting, and use of a web application firewall. The document also covers security misconfiguration (A5), giving examples like using default settings in production and exposing tracebacks.
1 of 115
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
More Related Content
«(Без)опасный Python», Иван Цыганов, Positive Technologies
12. A9
Using Components with
Known Vulnerabilities
Buffer overflow in the socket.recvfrom_into function in Modules/
socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and
3.4.x before 3.4rc1 allows remote attackers to execute arbitrary
code via a crafted string.
Publish Date : 2014-02-28
CVE-2014-1912
13. A9
Using Components with
Known Vulnerabilities
✤ Changelogs
✤ http://www.cvedetails.com/
✤ http://www.securitylab.ru/
✤ https://twitter.com/CVEnew/
14. OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack ProtectionA6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
15. OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack ProtectionA6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
16. OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack ProtectionA6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
25. A7
class User(db.Model, UserMixin):
id = db.Column(db.Integer, primary_key=True)
email = db.Column(db.String(255), unique=True)
password = db.Column(db.String(255))
active = db.Column(db.Boolean())
confirmed_at = db.Column(db.DateTime())
failed_login_attempts = db.Column(db.Integer(), default=0)
Attack protection
Flask-Security
26. A7
class SecureLoginForm(LoginForm):
captcha = RecaptchaField()
def show_captcha(self):
return self.user and self.user.failed_login_attempts > 4
def validate(self):
self.user = _datastore.get_user(self.email.data)
if not self.user:
return False
if not self.show_captcha():
del self._fields['captcha']
result = super().validate()
if not result:
self.user.failed_login_attempts += 1
else:
self.user.failed_login_attempts = 0
_datastore.put(self.user)
_datastore.commit()
return result
Attack protection
Flask-Security
64. Injection
XML
A1
from lxml import etree
user_xml = '''<?xml version="1.0"?>
<notifications>
<messages>disabled </messages>
<call>enabled </call>
</notifications>
'''
tree = etree.fromstring(user_xml)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value '{}'".format(value)
)
. . .
65. Injection
XML
A1
from lxml import etree
user_xml = '''<?xml version="1.0"?>
<!DOCTYPE root [ <!ENTITY passwd SYSTEM "file: ///etc/passwd">]>
<notifications>
<messages>&passwd; </messages>
<call>enabled </call>
</notifications>
'''
tree = etree.fromstring(user_xml)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value ‘{}’".format(value)
)
. . .
66. Injection. XML.A1
from lxml import etree
user_xml = '''<?xml version="1.0"?>
<!DOCTYPE root [ <!ENTITY passwd SYSTEM "file: ///etc/passwd">]>
<notifications>
<messages>&passwd; </messages>
<call>enabled </call>
</notifications>
'''
tree = etree.fromstring(user_xml)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value ‘{}’".format(value)
)
. . .
Traceback (most recent call last):
File «pycon_example.py", line 53, in <module>
"Incorrect value '{}'".format(setting.text)
ValueError: Incorrect value ' ##
# User Database
#
# Note that this file is consulted directly only when the
system is running
# in single-user mode. At other times this information is
provided by
# Open Directory.
#
# See the opendirectoryd(8) man page for additional
information about
# Open Directory.
##
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
67. Injection
XML
A1
from lxml import etree
user_xml = '''<?xml version="1.0"?>
<!DOCTYPE root [ <!ENTITY passwd SYSTEM "file: ///etc/passwd">]>
<notifications>
<messages>&passwd; </messages>
<call>enabled </call>
</notifications>
'''
tree = etree.fromstring(
user_xml, parser=etree.XMLParser(resolve_entities=False)
)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value '{}'".format(value)
68. Injection. XML.A1
from lxml import etree
user_xml = '''<?xml version="1.0"?>
<!DOCTYPE root [ <!ENTITY passwd SYSTEM "file: ///etc/passwd">]>
<notifications>
<messages>&passwd; </messages>
<call>enabled </call>
</notifications>
'''
tree = etree.fromstring(user_xml)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value ‘{}’".format(value)
)
. . .
Traceback (most recent call last):
File "pycon_example.py", line 53, in <module>
"Incorrect value '{}'".format(setting.text)
ValueError: Incorrect value 'None'
79. Injection
YAML
A1
Loading YAML
Warning: It is not safe to call yaml.load with
any data received from an untrusted source!
yaml.load is as powerful as pickle.load and so
may call any Python function. Check the
yaml.safe_load function though.
81. Injection
YAML
A1
user_input = '''
key: !!python/name:yaml.__version__
'''
data = yaml.safe_load(user_input)
yaml.constructor.ConstructorError: could not determine a constructor for the tag
'tag:yaml.org,2002:python/name:yaml.__version__'
in "<unicode string>", line 1, column 6:
key: !!python/name:yaml.__version__