CVE-2020-8545 (Python, published 2020-02-03T16:15Z)
Description: value: Global.py in AIL framework 2.8 allows path traversal.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/CIRCL/AIL-framework
Files changed:
bin/Global.py
Commit message: fix: [Global: filename provided by all feeders] avoid path tranversal


Vulnerable code:
        dirname = os.path.dirname(filename)
        if not os.path.exists(dirname):
            os.makedirs(dirname)

        decoded = base64.standard_b64decode(gzip64encoded)
        with open(filename, 'wb') as f:
            f.write(decoded)
        '''try:
            decoded2 = gunzip_bytes_obj(decoded)
        except:
            decoded2 =''
        type = magic.from_buffer(decoded2, mime=True)
        if type!= 'text/x-c++' and type!= 'text/html' and type!= 'text/x-c' and type!= 'text/x-python' and type!= 'text/x-php' and type!= 'application/xml' and type!= 'text/x-shellscript' and type!= 'text/plain' and type!= 'text/x-diff' and type!= 'text/x-ruby':
            print('-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------')
            print(filename)
            print(type)
            print('-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------')
        '''
        # remove PASTES_FOLDER from item path (crawled item + submited)
        if PASTES_FOLDERS in paste:
            paste = paste.replace(PASTES_FOLDERS, '', 1)
        p.populate_set_out(paste)
        processed_paste+=1

Fixed code:
    # get and sanityze PASTE DIRECTORY
    PASTES_FOLDERS = os.path.join(os.path.realpath(PASTES_FOLDERS), '')
        # remove PASTES_FOLDER from item path (crawled item + submited)
        if PASTES_FOLDERS in paste:
            paste = paste.replace(PASTES_FOLDERS, '', 1)

        filename = os.path.realpath(filename)
        # incorrect filename
        if not os.path.commonprefix([filename, PASTES_FOLDER]) == PASTES_FOLDER:
            print('Path traversal detected {}'.format(filename))
            publisher.warning('Global; Path traversal detected')
        else:
            dirname = os.path.dirname(filename)
            if not os.path.exists(dirname):
                os.makedirs(dirname)
            decoded = base64.standard_b64decode(gzip64encoded)
            with open(filename, 'wb') as f:
                f.write(decoded)
            '''try:
                decoded2 = gunzip_bytes_obj(decoded)
            except:
                decoded2 =''
            type = magic.from_buffer(decoded2, mime=True)
            if type!= 'text/x-c++' and type!= 'text/html' and type!= 'text/x-c' and type!= 'text/x-python' and type!= 'text/x-php' and type!= 'application/xml' and type!= 'text/x-shellscript' and type!= 'text/plain' and type!= 'text/x-diff' and type!= 'text/x-ruby':
                print('-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------')
                print(filename)
                print(type)
                print('-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------')
            '''
            p.populate_set_out(paste)
            processed_paste+=1