Skip to content

Python : Arbitrary code execution due to Js2Py  #832

@ghost

Description

Query PR

github/codeql#16771

Language

Python

CVE(s) ID list

CVE-2023-0297
GHSA-pf38-5p22-x6h6

CWE

CWE-094

Report

Js2Py is a Javascript to Python translation library written in Python. It allows users to invoke JavaScript code directly from Python. The Js2Py interpreter by default exposes the entire standard library to it's users. This can lead to security issues if a malicious input were directly.

The library provides two main ffunctions, eval_js annd eval_js6 to execute JS code. Any flow to these functions can lead to RCE.
The potential impact of this query can be significantly be if python imports arre disabled using the disable_pyimports call.
The proposed query detects the vulnerable pattern of a remote buffer flowing into any of the target functions. The query also supresses the results if imports are disabled to prevent false positives.

This vulnerability was found in pyload/pyload and was reported under CVE-2023-0297. The databases forr the same are available to download from the following links

https://file.io/qrMEjSJJoTq1
https://filetransfer.io/data-package/a02eab7V#link

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

  • Yes
  • No

Blog post link

No response

Metadata

Metadata

Labels

All For OneSubmissions to the All for One, One for All bounty

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions