[Python]: Add unsafe deserialization sinks

[maikypedia]

Query PR

github/codeql#13781

Language

Python

CVE(s) ID list

• CVE-2019-6446
• CVE-2020-13091
• CVE-2020-13092

CWE

CWE-502: Deserialization Of Untrusted Data

Report

This covers pandas, numpy and joblib unsafe deserialization vulnerability, that happens when an attacker is able to inject data into the deserialization method leading to Remote Code Execution. Both numpy and joblib don't deserialize the input itself but the content of the file, like other libraries modeled for insecure deserialization, but it is worth alerting. In the case of pandas the input could be an attacker url containing the data to deserialize and that could lead to Remote Code Execution.

The dataflow configuration I used is the Unsafe Deserialization default, looking for RemoteFlowSource flowing to the deserialization of data by pandas, numpy and joblib. The sinks are pandas.read_pickle, numpy.load and joblib.load.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

No response

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[xcorail]

Created Hackerone report 2187446 for bounty 517313 : [772] [Python]: Add unsafe deserialization sinks

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed