Vulnerabilities

 10 via 10 paths

Dependencies

 10

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 6
  • 3
Status
  • 10
  • 0
  • 0

critical severity

Unsafe Dependency Resolution

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.3.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to lack of verification or sandboxing in the StanfordSegmenter module, when unvalidated Java Archive (JAR) files are dynamically loaded. An attacker can execute arbitrary Java bytecode by supplying or replacing a JAR file, potentially through model poisoning, Man-in-the-Middle (MITM) attacks, or dependency poisoning.

Remediation

Upgrade nltk to version 3.9.3 or higher.

References

Unsafe Dependency Resolution vulnerability report

high severity

Directory Traversal

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.3.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal due to improper sanitization of file paths in the CorpusReader classes. An attacker can gain unauthorized access to sensitive files by supplying crafted file paths to applications that process user-controlled file inputs.

PoC

// PoC.py
from nltk.corpus.reader import WordListCorpusReader, TaggedCorpusReader, BracketParseCorpusReader
from nltk.corpus.reader.util import FileSystemPathPointer

root = FileSystemPathPointer("/")  # unrestricted access to filesystem

# test file - can be any sensitive system file
file_to_read = "etc/passwd"

print("Testing WordListCorpusReader")
reader1 = WordListCorpusReader(root, [file_to_read])
print(reader1.raw(file_to_read)[:200], "\n")

print("Testing TaggedCorpusReader")
reader2 = TaggedCorpusReader(root, [file_to_read])
print(reader2.raw(file_to_read)[:200], "\n")

print("Testing BracketParseCorpusReader")
reader3 = BracketParseCorpusReader(root, [file_to_read])
print(reader3.raw(file_to_read)[:200], "\n")

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade nltk to version 3.9.3 or higher.

References

Directory Traversal vulnerability report

high severity

Directory Traversal

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.3.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal via the filestring function. An attacker can access sensitive files by supplying specially crafted input paths, such as absolute paths or directory traversal sequences, to bypass input validation and read arbitrary files on the system.

Note:

This is only exploitable if the function processes untrusted user input, such as in web APIs or network-accessible services.

PoC

from nltk.util import filestring

#Arbitrary file read
content = filestring("/etc/passwd")
print(content)

#Windows Variant
#print(filestring("C:/Windows/System32/drivers/etc/hosts"))

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade nltk to version 3.9.3 or higher.

References

Directory Traversal vulnerability report

high severity

Remote Code Execution (RCE)

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) through the integrated data package download functionality. An attacker with control over the NLTK data index can execute arbitrary code by supplying pickled Python code within untrusted packages and trick a user into loading the malicious pickle.

Some packages found to be vulnerable if compromised are averaged_perceptron_tagger, punkt, maxent_ne_chunker, help/tagsets, and maxent_treebank_pos_tagger.

Remediation

Upgrade nltk to version 3.9 or higher.

References

Remote Code Execution (RCE) vulnerability report

high severity

Missing Authentication for Critical Function

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.4.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in WordNet Browser HTTP server in default configuration. An attacker can cause the service to terminate immediately by sending a specially crafted unauthenticated HTTP GET request (e.g. http://127.0.0.1:8004/SHUTDOWN%20THE%20SERVER) to the listening port.

Remediation

Upgrade nltk to version 3.9.4 or higher.

References

Missing Authentication for Critical Function vulnerability report

high severity

Arbitrary Code Injection

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.3.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the _unzip_iter() function due to the lack of validation before unpacking untrusted downloaded packages. An attacker can execute arbitrary code by supplying a specially crafted zip file.

Remediation

Upgrade nltk to version 3.9.3 or higher.

References

Arbitrary Code Injection vulnerability report

high severity

Directory Traversal

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.4.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal via the XML index file downloader. An attacker can overwrite arbitrary files and create directories at unintended locations by supplying malicious values for the subdir and id attributes containing path traversal sequences in a remote XML index file.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade nltk to version 3.9.4 or higher.

References

Directory Traversal vulnerability report

medium severity

Infinite loop

  • Vulnerable module: zipp
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1 › tqdm@4.68.2 › importlib-metadata@6.7.0 › zipp@3.15.0

Overview

Affected versions of this package are vulnerable to Infinite loop where an attacker can cause the application to stop responding by initiating a loop through functions affecting the Path module, such as joinpath, the overloaded division operator, and iterdir.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade zipp to version 3.19.1 or higher.

References

Infinite loop vulnerability report

medium severity

Cross-site Scripting (XSS)

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.4.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the lookup_... route in the web interface, where attacker-controlled input is reflected into the HTML response without proper escaping. An attacker can execute arbitrary JavaScript in the browser context of the application by convincing a user to open a crafted URL.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Type Origin Description
Stored Server The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected Server The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based Client The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

  • Web servers
  • Application servers
  • Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

  • Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
  • Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
  • Give users the option to disable client-side scripts.
  • Redirect invalid requests.
  • Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
  • Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
  • Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade nltk to version 3.9.4 or higher.

References

Cross-site Scripting (XSS) vulnerability report

medium severity

Uncontrolled Recursion

  • Vulnerable module: nltk
  • Introduced through: nltk@3.8.1

Detailed paths

  • Introduced through: h1alexbel/samples-filter@h1alexbel/samples-filter › nltk@3.8.1
    Remediation: Upgrade to nltk@3.9.4.

Overview

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the JSONTaggedDecoder.decode_obj() function in jsontags.py. An attacker can cause the application to crash by submitting a deeply nested JSON structure that exceeds the recursion limit, resulting in an unhandled exception.

PoC

import sys, json
from nltk.jsontags import JSONTaggedDecoder

depth = sys.getrecursionlimit() + 50  # e.g. 1050
payload = '{"x":' * depth + "null" + "}" * depth

# Raises RecursionError, crashing the process
json.loads(payload, cls=JSONTaggedDecoder)

Remediation

Upgrade nltk to version 3.9.4 or higher.

References

Uncontrolled Recursion vulnerability report