T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unbounded Third-Party Dependency Version<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1` and `README.md:50` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1`: ```text requests>=2.31.0 ``` `README.md:50`: ```bash pip install -r requirements.txt ``` ### Technical Analysis The project specifies only a minimum version of `requests`, without an upper bound, exact version, lock file, or package hashes. Consequently, installation can resolve to any future release of `requests` and to mutable versions of its transitive dependencies. This prevents the audited source tree from uniquely determining the code that will be installed. If a future direct or transitive dependency release is compromised, or if dependency resolution is performed against an untrusted package index, malicious package code could run during package build, installation, or subsequent import. No currently malicious package or dependency-confusion name was identified. The issue is the use of an unconstrained and unverifiable dependency resolution process. ### Attack Path 1. An attacker compromises a future release of `requests`, one of its transitive dependencies, or a package index used by the victim. 2. A user follows the documented installation command: ```bash pip install -r requirements.txt ``` 3. Because `requests>=2.31.0` accepts arbitrary later versions and no hashes are enforced, pip resolves and installs the compromised artifact. 4. Malicious code executes during package build or installation, or when `requests` is imported by `tools/aerobase.py`. 5. The code operates with the permissions of the user running pip or the CLI. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the installing or executing user. Depending on those privileges, the attacker could access user-readable files, environment variables such as `AEROBASE_API_KEY`, network resources, and writable p ...[truncated 276 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the direct dependency to a reviewed version rather than using a lower-bound-only constraint: ```text requests==<reviewed-version> ``` 2. Generate a lock file containing reviewed versions of all transitive dependencies. 3. Include cryptographic hashes and require their verification during installation: ```bash pip-compile --generate-hashes requirements.in pip install --require-hashes -r requirements.txt ``` 4. Configure installation to use only a trusted package index. 5. Add automated dependency vulnerability and integrity scanning to CI. 6. Establish a controlled update process that reviews and tests dependency changes before modifying the lock file. ]]>