Security vulnerabilities and automated fixes for python security issues
4 posts found
A critical XML External Entity (XXE) vulnerability was discovered in `scripts/screenshots/ui.py` where the native Python `xml.etree.ElementTree` library was used without XXE protections. The fix replaces the vulnerable import with `defusedxml.ElementTree`, which disables external entity processing by default and prevents attackers from exploiting XML parsing to access sensitive files or execute denial-of-service attacks.
A critical security hardening issue was discovered in `scripts/maimai/songs.py` where HTTP requests were made without SSL certificate verification and timeout values. This combination creates a Man-in-the-Middle (MITM) attack vector that could allow adversaries to intercept sensitive data or inject malicious content. The fix adds explicit SSL verification enforcement and request timeouts to all HTTP calls.
A critical shell injection vulnerability in `scripts/mkmultidtb.py` allowed attackers to execute arbitrary commands during the kernel build process by injecting shell metacharacters into device tree binary (DTB) filenames. The vulnerability was caused by using `os.system()` with string concatenation instead of proper subprocess argument handling. This fix migrates to `subprocess.run()` with argument lists, eliminating the attack surface entirely.
A medium-severity vulnerability was discovered in GitLab's export script where the subprocess module was used without proper security considerations, potentially enabling command injection attacks. This fix demonstrates why choosing the right process execution method is critical for application security, and how a simple module selection can make the difference between secure and vulnerable code.