CVE-2021-4315 (published 2023-01-28T23:15Z)

A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/NYUCCL/psiTurk
commit_details: repo_url: https://github.com/NYUCCL/psiTurk
author: Blaise Ritchie
author_date: 2021-06-16 11:05:28-07:00
msg: Fix SSTI vulnerability in ad and consent pages (#517)

* Fix SSTI vulnerability in ad and consent pages

Fixed an issue where users could pass arbitrary Python code to be executed on the server to the mode HTTP arg

More information about this type of vulnerability: https://secure-cookie.io/attacks/ssti/
repository: repo_url: https://github.com/NYUCCL/psiTurk
repo_name: NYUCCL/psiTurk
description: An open platform for science on Amazon Mechanical Turk.
repo_language: Python
owner: NYUCCL
file_changes: filename: experiment.py
change_type: ModificationType.MODIFY
diff: @@ -380,9 +380,10 @@ def advertisement():
         # even have accepted the HIT.
         with open('templates/ad.html', 'r') as temp_file:
             ad_string = temp_file.read()
-        ad_string = insert_mode(ad_string, mode)
+        ad_string = insert_mode(ad_string)
         return render_template_string(
             ad_string,
+            mode=mode,
             hitid=hit_id,
             assignmentid=assignment_id,
             workerid=worker_id
@@ -406,9 +407,10 @@ def give_consent():
     mode = request.args['mode']
     with open('templates/consent.html', 'r') as temp_file:
         consent_string = temp_file.read()
-    consent_string = insert_mode(consent_string, mode)
+    consent_string = insert_mode(consent_string)
     return render_template_string(
         consent_string,
+        mode=mode,
         hitid=hit_id,
         assignmentid=assignment_id,
         workerid=worker_id
@@ -731,7 +733,7 @@ def ppid():
 # to avoid breaking backwards compatibility with old templates.
 
 
-def insert_mode(page_html, mode):
+def insert_mode(page_html):
     """ Insert mode """
     page_html = page_html
     match_found = False
@@ -740,7 +742,7 @@ def insert_mode(page_html, mode):
     for match in matches:
         match_found = True
     if match_found:
-        new_html = page_html[:match.end()] + "&mode=" + mode +\
+        new_html = page_html[:match.end()] + '&mode={{ mode }}' +\
             page_html[match.end():]
         return new_html
     else:

programming_language: Python
filename: test_psiturk.py
change_type: ModificationType.MODIFY
diff: @@ -141,7 +141,7 @@ def test_insert_mode(psiturk_test_client):
         ad_string = temp_file.read()
 
     from psiturk.experiment import insert_mode
-    insert_mode(ad_string, 'debug')
+    insert_mode(ad_string)
 
 
 class PsiTurkStandardTests(PsiturkUnitTest):

programming_language: Python