T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/math_eval.py:11
- Finding
- Restricted eval Sandbox Escape Enables Arbitrary Code Execution## Vulnerability Details **File Location**: `scripts/math_eval.py`, lines 11-12 **Vulnerability Type**: Unsafe evaluation of attacker-controlled Python expressions **Risk Level**: High **Vulnerable Code**: ```python def safe_eval(expr): return eval(expr, {"__builtins__": {}}, SAFE_NAMES) ``` ### Technical Analysis The evaluator passes an attacker-controlled expression directly to Python's `eval()`. Removing `__builtins__` from the supplied global namespace is not an effective security boundary. Python literals created inside the expression remain full Python objects. An expression can traverse attributes such as `__class__`, `__base__`, and `__subclasses__` to inspect the runtime object graph. From suitable classes, an attacker may access function globals, recover built-in functions such as `__import__`, import operating-system modules, and invoke command-execution or file-access functions. The evaluator does not parse the expression into an abstract syntax tree or reject dangerous constructs such as attribute access, subscripting, comprehensions, lambdas, or arbitrary object traversal. Consequently, the documented mathematical namespace allowlist does not constrain the expression to mathematical operations. ### Attack Path 1. An attacker supplies a crafted Python expression through the `--expr` command-line argument. 2. The argument is passed unchanged to `safe_eval()`. 3. `eval()` interprets the expression as Python code rather than as a restricted mathematical grammar. 4. The expression traverses Python's object hierarchy through attributes such as `__class__` and `__subclasses__`. 5. It locates an accessible function or class whose globals expose built-in functionality. 6. It recovers import functionality, loads a system-access module, and invokes command execution or file operations. 7. The resulting operation runs with the operating-system permissions and environment of the evaluator process. ### Impac ...[truncated 748 chars]
- Remediation
- ## Remediation Suggestions Remove `eval()` entirely and implement a strict expression interpreter using `ast.parse(expr, mode="eval")`. The interpreter should: 1. Allow only numeric constants. 2. Allow only explicitly approved arithmetic operators, such as addition, subtraction, multiplication, division, modulo, and bounded exponentiation. 3. Permit function calls only when the function target is a simple approved name present in `SAFE_NAMES`. 4. Permit only explicitly approved constants such as `pi` and `e`. 5. Reject attribute access, subscripting, lambdas, comprehensions, container literals, assignment expressions, and every unrecognized AST node. 6. Evaluate approved nodes directly rather than compiling the validated tree and passing it back to `eval()`. 7. Add regression tests containing known Python sandbox-escape techniques to ensure they are rejected. Operating-system sandboxing, a low-privilege service account, filesystem restrictions, and network isolation should be used as defense in depth, not as substitutes for removing unsafe evaluation.