CVE-2023-39523 (published 2023-08-07T21:15Z)

ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append malicious commands in the `docker_reference` parameter.\n\nIn the function `scanpipe/pipes/fetch.py:fetch_docker_image` the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`.  However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of `docker://;`, it would allow appending malicious commands.\n\nVersion 32.5.1 contains a patch for this issue. The `docker_reference` input should be sanitized to avoid command injections and, as a workaround, one may avoid creating commands with user controlled input directly.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/nexB/scancode.io
commit_details: repo_url: https://github.com/nexB/scancode.io
author: mpij
author_date: 2023-08-07 16:38:33+02:00
msg: Merge pull request from GHSA-2ggp-cmvm-f62f

- Regex that validates docker_reference variable
- Securing against possible command injection
repository: repo_url: https://github.com/nexB/scancode.io
repo_name: nexB/scancode.io
description: ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!
repo_language: Python
owner: nexB
file_changes: filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -278,7 +278,7 @@ def run_command(cmd, log_output=False):
 
     process = subprocess.Popen(
         cmd,
-        shell=True,
+        shell=False,
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
         universal_newlines=True,

programming_language: Python
filename: fetch.py
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,7 @@ import cgi
 import json
 import logging
 import os
+import re
 import tempfile
 from collections import namedtuple
 from pathlib import Path
@@ -190,6 +191,11 @@ def fetch_docker_image(docker_reference, to=None):
     Docker references are documented here:
     https://github.com/containers/skopeo/blob/0faf16017/docs/skopeo.1.md#image-names
     """
+
+    whitelist = r"^docker://[a-zA-Z0-9_.:/@-]+$"
+    if not re.match(whitelist, docker_reference):
+        raise ValueError("Invalid Docker reference.")
+
     name = python_safe_name(docker_reference.replace("docker://", ""))
     filename = f"{name}.tar"
     download_directory = to or tempfile.mkdtemp()

programming_language: Python