RestrictedPython Protected Hook Bypass in Argument Validation

Detection Guidance

This vulnerability involves the use of positional-only parameters named with protected guard hook names (such as _getattr_, _getitem_, _write_, or _print_) in RestrictedPython code. To detect this vulnerability, you need to analyze the Python code being executed or compiled in your environment to identify functions that define positional-only parameters with names starting with an underscore that match these protected names.

Since the vulnerability is in the source code of RestrictedPython scripts or modules, detection involves static code analysis or runtime inspection of the function definitions.

Suggested approach:

• Search for function definitions that use positional-only parameters (parameters before the '/' in the function signature) named _getattr_, _getitem_, _write_, or _print_.
• Use static code analysis tools or custom scripts to parse Python source files for such patterns.

Example command using grep (assuming source files are accessible):

• grep -Pr "def .*\(.*_getattr_.*\/.*\)" /path/to/restrictedpython/code
• grep -Pr "def .*\(.*_getitem_.*\/.*\)" /path/to/restrictedpython/code
• grep -Pr "def .*\(.*_write_.*\/.*\)" /path/to/restrictedpython/code
• grep -Pr "def .*\(.*_print_.*\/.*\)" /path/to/restrictedpython/code

Alternatively, write a Python script to parse function signatures and check for positional-only parameters with these protected names.

Note that detection depends on having access to the RestrictedPython code being executed or compiled. Network detection is not straightforward since this is a code-level vulnerability.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in RestrictedPython versions prior to 8.3. RestrictedPython is a tool designed to define a subset of the Python language to safely execute code in a trusted environment. The issue arises because the function check_function_argument_names() did not properly reject protected guard hook names for positional-only arguments. This omission allowed certain special names like __getattr__, _getitem_, _write_, or _print_ to be shadowed by local parameters, effectively bypassing the access control policies of the embedding application.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a bypass of the embedding application's access policy, potentially allowing an attacker to execute unauthorized actions or access restricted data within the trusted environment. Given the CVSS base score of 8.3 with high impact on confidentiality, integrity, and low impact on availability, this could result in significant security breaches including data exposure or manipulation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade RestrictedPython to version 8.3 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in RestrictedPython prior to version 8.3 allows certain protected guard hook names to be shadowed by local parameters, which can bypass the embedding application's access policy. This can lead to unauthorized access or modification of data within the trusted environment.

Such unauthorized access or data manipulation could potentially impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data access, integrity, and confidentiality.

However, the provided information does not explicitly describe the direct effects on compliance with these standards.

Useful 0 Not Useful 0