CVE-2021-38606 (published 2021-08-12T16:15Z)

reNgine through 0.5 relies on a predictable directory name.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-330
cwe_name: Use of Insufficiently Random Values
description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
extended_description: When product generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.
         

Fix information:
repo_url: https://github.com/yogeshojha/rengine
commit_details: repo_url: https://github.com/yogeshojha/rengine
author: Yogesh Ojha
author_date: 2021-08-11 22:04:49+05:30
msg: Predictable directory name fixed, reported by Rob - 303sec, Thanks!
repository: repo_url: https://github.com/yogeshojha/rengine
repo_name: yogeshojha/rengine
description: reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
repo_language: HTML
owner: yogeshojha
file_changes: filename: tasks.py
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,7 @@ import yaml
 import json
 import csv
 import validators
+import random
 import requests
 import logging
 import metafinder.extractor as metadata_extractor
@@ -97,8 +98,7 @@ def initiate_scan(
         send_notification('reNgine has initiated recon for target {} with engine type {}'.format(domain.name, engine_object.engine_name))
 
     try:
-        current_scan_dir = domain.name + '_' + \
-            str(datetime.datetime.strftime(timezone.now(), '%Y_%m_%d_%H_%M_%S'))
+        current_scan_dir = domain.name + '_' + str(random.randint(100000000000, 999999999999))
         os.mkdir(current_scan_dir)
         task.results_dir = current_scan_dir
         task.save()
@@ -257,7 +257,7 @@ def initiate_scan(
     task.stop_scan_date = timezone.now()
     task.save()
     # cleanup results
-    # delete_scan_data(results_dir)
+    delete_scan_data(results_dir)
     return {"status": True}
 
 
@@ -1334,7 +1334,7 @@ def vulnerability_scan(
                         if Hackerone.objects.all().exists() and severity != 'info' and severity \
                             != 'low' and vulnerability.target_domain.h1_team_handle:
                             hackerone = Hackerone.objects.all()[0]
-                            
+
                             if hackerone.send_critical and severity == 'critical':
                                 send_hackerone_report(vulnerability.id)
                             elif hackerone.send_high and severity == 'high':

programming_language: Python
filename: views.py
change_type: ModificationType.MODIFY
diff: @@ -258,10 +258,8 @@ def export_urls(request, scan_id):
 def delete_scan(request, id):
     obj = get_object_or_404(ScanHistory, id=id)
     if request.method == "POST":
-        delete_dir = obj.domain.name + '_' + \
-            str(datetime.datetime.strftime(obj.start_scan_date, '%Y_%m_%d_%H_%M_%S'))
-        delete_path = settings.TOOL_LOCATION + 'scan_results/' + delete_dir
-        os.system('rm -rf ' + delete_path)
+        delete_dir = obj.results_dir
+        os.system('rm -rf /usr/src/scan_results/' + delete_dir)
         obj.delete()
         messageData = {'status': 'true'}
         messages.add_message(
@@ -613,7 +611,10 @@ def delete_scans(request):
 
         for key, value in request.POST.items():
             if key != "scan_history_table_length" and key != "csrfmiddlewaretoken":
-                ScanHistory.objects.filter(id=value).delete()
+                obj = get_object_or_404(ScanHistory, id=value)
+                delete_dir = obj.results_dir
+                os.system('rm -rf /usr/src/scan_results/' + delete_dir)
+                obj.delete()
         messages.add_message(
             request,
             messages.INFO,

programming_language: Python