26
27 async def on_ready(self):
28 print("Running. Printing wd")
29 os.system("pwd")30 self.staff_chat = self.get_channel(907937553343209472)
31 dotenv.load_dotenv(".env")
32 self.host = os.getenv("DB_HOST")196 return
197 await ctx.send("Restarting...")
198 await self.staff_chat.send(f"{ctx.author.mention} has restarted the bot.")
199 subprocess.call("python3 main.py", shell=True)200 self.bot.close()
201
202 @commands.command(name="rename", alias=["ren"], description="Rename a file")Python possesses many mechanisms to invoke an external executable. If the desired executable path is not fully qualified relative to the filesystem root then this may present a potential security risk.
In POSIX environments, the PATH environment variable is used to specify a set of standard locations that will be searched for the first matching named executable. While convenient, this behavior may allow a malicious actor to exert control over a system. If they are able to adjust the contents of the PATH variable, or manipulate the file system, then a bogus executable may be discovered in place of the desired one. This executable will be invoked with the user privileges of the Python process that spawned it, potentially a highly privileged user.
This test will scan the parameters of all configured Python methods, looking for paths that do not start at the filesystem root, that is, do not have a leading ‘/’ character.
Bad practice
import subprocess
subprocess.run(['calculator', '-u', 'critical', msg], check=True) # Sensitive, Path not qualified from root
Recommended
import subprocess
subprocess.run(['/usr/bin/calculator', '-u', 'critical', msg], check=True) # Path qualified from root
References:
- Bandit B607
- OWASP Top 10 2021 Category A03 - Injection