A9 Using Components with
Known Vulnerabilities
https: // www.cvedetails.com/product/18211/Djangoproject-Django.html
Slide 11
Slide 11 text
A9 Using Components with
Known Vulnerabilities
http: // www.cvedetails.com/product/18230/Python-Python.html
Slide 12
Slide 12 text
A9 Using Components with
Known Vulnerabilities
Buffer overflow in the socket.recvfrom_into function in Modules/
socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and
3.4.x before 3.4rc1 allows remote attackers to execute arbitrary
code via a crafted string.
Publish Date : 2014-02-28
CVE-2014-1912
Slide 13
Slide 13 text
A9 Using Components with
Known Vulnerabilities
✤ Changelogs
✤ http://www.cvedetails.com/
✤ http://www.securitylab.ru/
✤ https://twitter.com/CVEnew/
Slide 14
Slide 14 text
OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack Protection
A6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
Slide 15
Slide 15 text
OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack Protection
A6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
Slide 16
Slide 16 text
OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack Protection
A6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
A7
class User(db.Model, UserMixin):
id = db.Column(db.Integer, primary_key=True)
email = db.Column(db.String(255), unique=True)
password = db.Column(db.String(255))
active = db.Column(db.Boolean())
confirmed_at = db.Column(db.DateTime())
failed_login_attempts = db.Column(db.Integer(), default=0)
Attack protection
Flask-Security
Slide 26
Slide 26 text
A7
class SecureLoginForm(LoginForm):
captcha = RecaptchaField()
def show_captcha(self):
return self.user and self.user.failed_login_attempts > 4
def validate(self):
self.user = _datastore.get_user(self.email.data)
if not self.user:
return False
if not self.show_captcha():
del self._fields['captcha']
result = super().validate()
if not result:
self.user.failed_login_attempts += 1
else:
self.user.failed_login_attempts = 0
_datastore.put(self.user)
_datastore.commit()
return result
Attack protection
Flask-Security
Slide 27
Slide 27 text
A7
{% from "security/_macros.html" import render_field_with_errors, render_field %}
{% include "security/_messages.html" %}
A5 Security Misconfiguration
https: //github.com/yandex/gixy
✤ Server Side Request Forgery
✤ HTTP Splitting
✤ Problems with referrer/origin validation
✤ Redefining of response headers by "add_header" directive
✤ Request's Host header forgery
✤ none in valid_referers
✤ Multiline response headers
GIXY
Slide 59
Slide 59 text
A5 Security Misconfiguration
✤ Read documentation
✤ Use tools to check your configs
✤ Separate production/development env
Slide 60
Slide 60 text
OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack Protection
A6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
Slide 61
Slide 61 text
OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack Protection
A6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
Slide 62
Slide 62 text
OWASP TOP 10 2017
A1 Injection A2 Broken Authentication and Session
Management
A3 XSS A4 Broken Access
Control A5 Security Misconfiguration
A7 Insufficient Attack Protection
A6 Sensitive Data Exposure
A8 CSRF A9 Components with
Vulnerabilities
A10 Underprotected
APIs
Slide 63
Slide 63 text
A1
Injection
XML
Slide 64
Slide 64 text
Injection
XML
A1
from lxml import etree
user_xml = '''
disabled
enabled
'''
tree = etree.fromstring(user_xml)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value '{}'".format(value)
)
. . .
Slide 65
Slide 65 text
Injection
XML
A1
from lxml import etree
user_xml = '''
]>
&passwd;
enabled
'''
tree = etree.fromstring(user_xml)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value ‘{}’".format(value)
)
. . .
Slide 66
Slide 66 text
Injection. XML.
A1
from lxml import etree
user_xml = '''
]>
&passwd;
enabled
'''
tree = etree.fromstring(user_xml)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value ‘{}’".format(value)
)
. . .
Traceback (most recent call last):
File «pycon_example.py", line 53, in
"Incorrect value '{}'".format(setting.text)
ValueError: Incorrect value ' ##
# User Database
#
# Note that this file is consulted directly only when the
system is running
# in single-user mode. At other times this information is
provided by
# Open Directory.
#
# See the opendirectoryd(8) man page for additional
information about
# Open Directory.
##
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
Slide 67
Slide 67 text
Injection
XML
A1
from lxml import etree
user_xml = '''
]>
&passwd;
enabled
'''
tree = etree.fromstring(
user_xml, parser=etree.XMLParser(resolve_entities=False)
)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value '{}'".format(value)
Slide 68
Slide 68 text
Injection. XML.
A1
from lxml import etree
user_xml = '''
]>
&passwd;
enabled
'''
tree = etree.fromstring(user_xml)
for setting in tree.xpath('/notifications /*'):
if setting.text not in ('enabled', 'disabled'):
raise ValueError(
"Incorrect value ‘{}’".format(value)
)
. . .
Traceback (most recent call last):
File "pycon_example.py", line 53, in
"Incorrect value '{}'".format(setting.text)
ValueError: Incorrect value 'None'
Slide 69
Slide 69 text
https: //hackerone.com/reports/99279
Slide 70
Slide 70 text
A1
Injection
YAML
Slide 71
Slide 71 text
Injection
YAML
A1
user_input = '''
key: value
'''
data = yaml.load(user_input)
Slide 72
Slide 72 text
Injection
YAML
A1
user_input = '''
key: value
'''
data = yaml.load(user_input)
{'key': 'value'}
Injection
YAML
A1
Loading YAML
Warning: It is not safe to call yaml.load with
any data received from an untrusted source!
yaml.load is as powerful as pickle.load and so
may call any Python function. Check the
yaml.safe_load function though.
Injection
YAML
A1
user_input = '''
key: !!python/name:yaml.__version__
'''
data = yaml.safe_load(user_input)
yaml.constructor.ConstructorError: could not determine a constructor for the tag
'tag:yaml.org,2002:python/name:yaml.__version__'
in "", line 1, column 6:
key: !!python/name:yaml.__version__
Slide 82
Slide 82 text
A1
Injection
Templates
Slide 83
Slide 83 text
Injection
Templates
A1
from flask import render_template_string
user = 'Admin'
template = 'Hello, %s!' % user
render_template_string(template)