When str.lower() is a security vulnerability in Python – Seth Larson(sethmlarson.dev)
24 pointsby rbanffyan hour ago4 comments
  • echoangle35 minutes ago
    > This is why calling str.lower() represents a difference in the implementation and the specification, and therefore a vulnerability:

    I wish there was some explanation how this is a vulnerability and not just a bug generating erroneous data.

    Vulnerability for me sounds like there’s a reasonable way to create an exploit from the bug, and I don’t see one here as someone who’s not very familiar with the topic.

    • SethMLarson30 minutes ago
      Author here, that's a good idea. A straightforward way to exploit an implementation differential like this is if you have a software system that contains two different implementations of IDNA 2003 processing user input. One part of the process processes the domain correctly, the other incorrectly, and in this case you can have one part of a system (such as a policy/filter) "see" the data one way and the other part of the system (such as, taking an action as a result of the data) see the data in another way.

      Server-side Request Forgery (SSRF) is an example of such an exploit targeting a differential in implementations of URL parsers, which is similar to this implementation difference.

      • AgentOrange123413 minutes ago
        "if you have a software system that contains two different implementations of IDNA 2003 processing user input"

        Is that a real thing though? Is someone doing that?

        • gchamonlive9 minutes ago
          It isn't until it is, until during a crunch someone adds a package with that condition and eventually that gets exploited or halts the system. It's never a nitpick to shed your system from undesired state because of how complex systems behave.
        • kccqzy8 minutes ago
          It could be an implementation written in the buggy Python and another written in a different language.

          For example you might use a ready-made WAF written in a non-Python language in front of a Python app.

    • tptacek29 minutes ago
      It creates a parser differential; two different components of the system can treat the same string as different hostnames. Things that have trusted hostnames, or privileged/admin hostnames that are screened out, or SSRF filters all depend on accurately comparing presented hostnames.

      This is pretty situational, though, isn't it? You still have to be dealing with IDN names.

    • floxy18 minutes ago
      I suppose I could envision a scenario like: Service A has a "reset your password" option. Someone with a "user@popular-unicode-domain.com" tries to use this option. Normally this fails when mangled-popular-unicode-domain-plus-garbage.com can't be found. Enterprising malicious actor registers mangled-popular-unicode-domain-plus-garbage.com, and now gets a hold of user password reset requests.
    • zaphar29 minutes ago
      I'm too lazy to investigate further but my guess is that if there is a vulnerability here it has something to do with dns name spoofing.
  • tialaramex15 minutes ago
    This idiocy is a big part of why it was so important to get Python people working on TLS implementations to understand that the defined mechanism for SANs (no the "alternative" in Subject Alternative Name doesn't mean in the sense of more than one, X.509 is originally for the X.500 system and the Internet repurposed X.509 so these are alternative names from the Internet) says that these are DNS names, they specifically are not to be understood as some sort of human readable text, and thus "decoding" them to Unicode is definitely nonsense even though Python really wanted to do that and I think used to do it or at least proposed to.

    The rule for how SAN DnsNames match againt like names, from the DNS is very, very simple so that you don't screw it up. You handle a single wildcard (ASCII * code 42 matches any single DNS label) and beyond that it's literally byte comparison. You don't care what these bytes mean, either the bytes are all identical or that's not a match and we're done.

  • tescreal10 minutes ago
    it would be good to look for ".lower()" squatters if you host on an idn.
  • cat-whisperer27 minutes ago
    the horrors of versioning