CVE-2024-34060: Insufficient Information (NVD-CWE-noinfo)
value: IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iris-web` that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely handled and may cause an Arbitrary File Write. This can lead to a remote code execution (RCE) when combined with a Server Side Template Injection (SSTI). This vulnerability has been patched in version 1.0.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-23T12:15Z
Repository: https://github.com/dfir-iris/iris-evtx-module
Language: Python
Files changed: iris_evtx/IrisEVTXInterface.py, requirements.txt
Commit date: 2024-02-04 17:05:13 +0100
Commit message: [FIX] Filename secure escape

Diff: diff --git a/iris_evtx/IrisEVTXInterface.py b/iris_evtx/IrisEVTXInterface.py
index a7a9737..95c5baa 100644
--- a/iris_evtx/IrisEVTXInterface.py
+++ b/iris_evtx/IrisEVTXInterface.py
@@ -18,16 +18,17 @@
 #  along with this program; if not, write to the Free Software Foundation,
 #  Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 import traceback
 from pathlib import Path
-from celery import chain, current_app
+from werkzeug.utils import secure_filename
 
-from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes
 import iris_interface.IrisInterfaceStatus as InterfaceStatus
-from iris_evtx.EVTXImportDispatcher import ImportDispatcher
+from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes
+
 import iris_evtx.IrisEVTXModConfig as interface_conf
+from iris_evtx.EVTXImportDispatcher import ImportDispatcher
 
 
 class IrisEVTXInterface(IrisModuleInterface):
     """
     Provide the interface between Iris and Evtx2Splunk
@@ -66,11 +67,13 @@ class IrisEVTXInterface(IrisModuleInterface):
         Handle the files for a specific
         :return:
         """
 
         if base_path and Path(base_path).is_dir:
-            file_handle.save(Path(base_path, file_handle.filename))
+            # Sanitize the filename
+            file_name = secure_filename(file_handle.filename)
+            file_handle.save(Path(base_path, file_name))
             return InterfaceStatus.I2Success("Successfully saved file {} to {}".format(file_handle.filename, base_path))
 
         else:
             return InterfaceStatus.I2Error("Directory {} not found. Can't save file".format(base_path))
 
diff --git a/requirements.txt b/requirements.txt
index 3156e48..9ececb1 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,6 @@
 setuptools~=46.1.3
 celery~=4.4.7
 pyunpack~=0.2.2
 evtx2splunk~=2.0.1
-iris_interface==1.2.0
\ No newline at end of file
+iris_interface==1.2.0
+werkzeug
\ No newline at end of file

Vulnerable code: from celery import chain, current_app
from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes
from iris_evtx.EVTXImportDispatcher import ImportDispatcher
            file_handle.save(Path(base_path, file_handle.filename))
iris_interface==1.2.0
Fixed code: from werkzeug.utils import secure_filename
from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes

from iris_evtx.EVTXImportDispatcher import ImportDispatcher
            # Sanitize the filename
            file_name = secure_filename(file_handle.filename)
            file_handle.save(Path(base_path, file_name))
iris_interface==1.2.0
werkzeug