Dev6 #77
Dev6 #77
Conversation
…shellcode, new style of c2, download_c2 and upload_c2 and much much more
…shellcode, new style of c2, download_c2 and upload_c2 and much much more
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| contentr = "client_id;os;command:output\n" | ||
| contentr += f"{client_id};{client};{command};{output}\n" | ||
| csv_file = f"sessions/{client_id}.log" | ||
| file_exists = os.path.isfile(csv_file) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 months ago
To fix the problem, we need to validate and sanitize the client_id before using it to construct the file path. We can use a combination of normalization and validation to ensure that the constructed path is within the intended directory. Specifically, we will:
- Normalize the path using
os.path.normpathto remove any ".." segments. - Ensure that the normalized path starts with the intended base directory (
sessions).
| @@ -138,3 +138,6 @@ | ||
| contentr += f"{client_id};{client};{command};{output}\n" | ||
| csv_file = f"sessions/{client_id}.log" | ||
| base_path = 'sessions' | ||
| csv_file = os.path.normpath(os.path.join(base_path, f"{client_id}.log")) | ||
| if not csv_file.startswith(base_path): | ||
| raise Exception("Invalid client_id") | ||
| file_exists = os.path.isfile(csv_file) |
| contentr += f"{client_id};{client};{command};{output}\n" | ||
| csv_file = f"sessions/{client_id}.log" | ||
| file_exists = os.path.isfile(csv_file) | ||
| with open(csv_file, 'a', newline='') as f: |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 months ago
To fix the problem, we need to validate and sanitize the client_id before using it to construct the file path. We can use a combination of os.path.normpath and os.path.join to ensure that the constructed path is within the intended directory. Additionally, we can use a regular expression to validate that client_id contains only safe characters (e.g., alphanumeric characters and underscores).
- Normalize the
client_idusingos.path.normpath. - Ensure that the resulting path is within the
sessionsdirectory. - Validate
client_idusing a regular expression to allow only safe characters.
| @@ -138,3 +138,6 @@ | ||
| contentr += f"{client_id};{client};{command};{output}\n" | ||
| csv_file = f"sessions/{client_id}.log" | ||
| safe_client_id = re.sub(r'[^a-zA-Z0-9_]', '', client_id) | ||
| csv_file = os.path.normpath(os.path.join('sessions', f"{safe_client_id}.log")) | ||
| if not csv_file.startswith(os.path.abspath('sessions')): | ||
| raise Exception("Invalid client_id") | ||
| file_exists = os.path.isfile(csv_file) |
Descripción
<-- Agrega una descripción del user story !-->
Resumen de los cambios
<-- Agrega una breve descripción de los cambios !-->
Checklist
Notas
<-- Agrega notas adicionales !-->
Screensshots