CVE-2024-28111 (Python, published 2024-03-06T22:15Z)
Description: value: Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-based Canarytoken to target the Canarytoken's owner, if the owner exports the incident history to CSV and opens in a reader application such as Microsoft Excel. The impact is that this issue could lead to code execution on the machine on which the CSV file is opened. Version sha-c595a1f8 contains a fix for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thinkst/canarytokens
Files changed:
.devcontainer/library-scripts/custom-installs.sh
.github/workflows/test.yml
aws-css-token-infra/CSSClonedSiteCFFunc/index.js
canarytokens/canarydrop.py
canarytokens/channel_dns.py
Commit message: Fix CSV injection vulnerability (#355)

See https://github.com/thinkst/canarytokens/security/advisories/GHSA-fqh6-v4qp-65fv, thanks to @iodn for reporting.

(Also fixes broken build scripts for development, and the test pipeline. K8s changed repo details :/)

Vulnerable code:
# curl -sSL https://install.python-poetry.org | POETRY_HOME=/home/vscode/.local python -
# /home/vscode/.local/bin/poetry config virtualenvs.in-project true

# wget https://golang.org/dl/go1.18.2.linux-amd64.tar.gz
# tar -C /usr/local -xzf go1.18.2.linux-amd64.tar.gz
# /usr/local/go/bin/go install github.com/aquasecurity/tfsec/cmd/tfsec@latest

sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg  https://dl.k8s.io/apt/doc/apt-key.gpg
sudo install -o root -g root -m 644 /usr/share/keyrings/kubernetes-archive-keyring.gpg /etc/apt/trusted.gpg.d/
sudo echo "deb [signed-by=/etc/apt/trusted.gpg.d/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update -y
sudo apt-get install -y kubectl
          sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://dl.k8s.io/apt/doc/apt-key.gpg
          echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
          sudo apt-get install -y kubectl
    if (expected_referrer == '' || referer == '' || referer_origin.endsWith(expected_referrer) || referer_origin.endsWith(event.context.distributionDomainName)) { 
        // Happy case where the referer matches   
        writer = csv.writer(csvOutput)
                    data.append(hit_dict.get(key, "N/A"))
            ttl=300

Fixed code:
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys B7B3B788A8D3785C
mkdir -p /etc/apt/keyrings
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 234654DA9A296436
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.28/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list
apt-get update -y
apt-get install -y kubectl=1.28.1-1.1
    if (expected_referrer == '' || referer == '' || referer_origin.endsWith(expected_referrer) || referer_origin.endsWith(event.context.distributionDomainName)) {
        // Happy case where the referer matches
        def escape_csv_field(data) -> str:
            data = f"'{data}"
            return data

        writer = csv.writer(csvOutput, quoting=csv.QUOTE_ALL)
                    csv_field = hit_dict.get(key, "N/A")

                    # The row includeds non-str objects, but they are all passed through __str__() by CSV writer,
                    # so we sanitise those and add strings only to the row.
                    csv_field = escape_csv_field(csv_field.__str__())
                    data.append(csv_field)
            ttl=300,