thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/python/seed-046 2.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via urllib.request.urlopen with unvalidated user URL
+
+import urllib.request
+import urllib.parse
+from django.http import JsonResponse
+
+
+def fetch_remote_resource(request):
+    """Fetch an external resource on behalf of the client."""
+    url = request.GET.get("url", "")
+
+    # No validation — internal URLs, file://, gopher:// etc. all accepted
+    try:
+        with urllib.request.urlopen(url, timeout=10) as response:
+            content = response.read(4096).decode("utf-8", errors="replace")
+            content_type = response.headers.get("Content-Type", "")
+        return JsonResponse({"content": content, "content_type": content_type})
+    except Exception as e:
+        return JsonResponse({"error": str(e)}, status=400)
+
+
+def check_url_status(request):
+    target = request.POST.get("target", "")
+    try:
+        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return JsonResponse({"status": resp.status, "url": target})
+    except urllib.error.HTTPError as e:
+        return JsonResponse({"status": e.code})

package/dist/packages/crucible/seeds/python/seed-046 3.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via urllib.request.urlopen with unvalidated user URL
+
+import urllib.request
+import urllib.parse
+from django.http import JsonResponse
+
+
+def fetch_remote_resource(request):
+    """Fetch an external resource on behalf of the client."""
+    url = request.GET.get("url", "")
+
+    # No validation — internal URLs, file://, gopher:// etc. all accepted
+    try:
+        with urllib.request.urlopen(url, timeout=10) as response:
+            content = response.read(4096).decode("utf-8", errors="replace")
+            content_type = response.headers.get("Content-Type", "")
+        return JsonResponse({"content": content, "content_type": content_type})
+    except Exception as e:
+        return JsonResponse({"error": str(e)}, status=400)
+
+
+def check_url_status(request):
+    target = request.POST.get("target", "")
+    try:
+        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return JsonResponse({"status": resp.status, "url": target})
+    except urllib.error.HTTPError as e:
+        return JsonResponse({"status": e.code})

package/dist/packages/crucible/seeds/python/seed-046.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via urllib.request.urlopen with unvalidated user URL
+
+import urllib.request
+import urllib.parse
+from django.http import JsonResponse
+
+
+def fetch_remote_resource(request):
+    """Fetch an external resource on behalf of the client."""
+    url = request.GET.get("url", "")
+
+    # No validation — internal URLs, file://, gopher:// etc. all accepted
+    try:
+        with urllib.request.urlopen(url, timeout=10) as response:
+            content = response.read(4096).decode("utf-8", errors="replace")
+            content_type = response.headers.get("Content-Type", "")
+        return JsonResponse({"content": content, "content_type": content_type})
+    except Exception as e:
+        return JsonResponse({"error": str(e)}, status=400)
+
+
+def check_url_status(request):
+    target = request.POST.get("target", "")
+    try:
+        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return JsonResponse({"status": resp.status, "url": target})
+    except urllib.error.HTTPError as e:
+        return JsonResponse({"status": e.code})

package/dist/packages/crucible/seeds/python/seed-047 2.py

@@ -0,0 +1,44 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
+
+import aiohttp
+from fastapi import FastAPI, Body
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class NotificationConfig(BaseModel):
+    webhook_url: str    # user-controlled
+    event_type: str
+    secret: str = ""
+
+
+class ImportRequest(BaseModel):
+    data_url: str       # user-controlled source URL
+    format: str = "json"
+
+
+@app.post("/notifications/send")
+async def send_notification(config: NotificationConfig):
+    async with aiohttp.ClientSession() as session:
+        # webhook_url from user — attacker targets http://10.0.0.1/admin
+        async with session.post(
+            config.webhook_url,
+            json={"event": config.event_type},
+            headers={"X-Secret": config.secret},
+            timeout=aiohttp.ClientTimeout(total=10),
+            allow_redirects=True,  # follows redirects — pivot to internal
+        ) as resp:
+            return {"status": resp.status}
+
+
+@app.post("/data/import")
+async def import_data(req: ImportRequest):
+    async with aiohttp.ClientSession() as session:
+        async with session.get(req.data_url) as resp:
+            data = await resp.text()
+    return {"preview": data[:500], "format": req.format}

package/dist/packages/crucible/seeds/python/seed-047 3.py

@@ -0,0 +1,44 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
+
+import aiohttp
+from fastapi import FastAPI, Body
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class NotificationConfig(BaseModel):
+    webhook_url: str    # user-controlled
+    event_type: str
+    secret: str = ""
+
+
+class ImportRequest(BaseModel):
+    data_url: str       # user-controlled source URL
+    format: str = "json"
+
+
+@app.post("/notifications/send")
+async def send_notification(config: NotificationConfig):
+    async with aiohttp.ClientSession() as session:
+        # webhook_url from user — attacker targets http://10.0.0.1/admin
+        async with session.post(
+            config.webhook_url,
+            json={"event": config.event_type},
+            headers={"X-Secret": config.secret},
+            timeout=aiohttp.ClientTimeout(total=10),
+            allow_redirects=True,  # follows redirects — pivot to internal
+        ) as resp:
+            return {"status": resp.status}
+
+
+@app.post("/data/import")
+async def import_data(req: ImportRequest):
+    async with aiohttp.ClientSession() as session:
+        async with session.get(req.data_url) as resp:
+            data = await resp.text()
+    return {"preview": data[:500], "format": req.format}

package/dist/packages/crucible/seeds/python/seed-047.py

@@ -0,0 +1,44 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
+
+import aiohttp
+from fastapi import FastAPI, Body
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class NotificationConfig(BaseModel):
+    webhook_url: str    # user-controlled
+    event_type: str
+    secret: str = ""
+
+
+class ImportRequest(BaseModel):
+    data_url: str       # user-controlled source URL
+    format: str = "json"
+
+
+@app.post("/notifications/send")
+async def send_notification(config: NotificationConfig):
+    async with aiohttp.ClientSession() as session:
+        # webhook_url from user — attacker targets http://10.0.0.1/admin
+        async with session.post(
+            config.webhook_url,
+            json={"event": config.event_type},
+            headers={"X-Secret": config.secret},
+            timeout=aiohttp.ClientTimeout(total=10),
+            allow_redirects=True,  # follows redirects — pivot to internal
+        ) as resp:
+            return {"status": resp.status}
+
+
+@app.post("/data/import")
+async def import_data(req: ImportRequest):
+    async with aiohttp.ClientSession() as session:
+        async with session.get(req.data_url) as resp:
+            data = await resp.text()
+    return {"preview": data[:500], "format": req.format}

package/dist/packages/crucible/seeds/python/seed-048 2.py

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.loads used with untrusted data — arbitrary code execution
+
+import pickle
+import base64
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/session/restore", methods=["POST"])
+def restore_session():
+    session_data = request.cookies.get("session", "")
+    if not session_data:
+        return jsonify({"error": "No session"}), 401
+
+    try:
+        # pickle.loads executes arbitrary Python code embedded in the payload
+        # Attacker payload: object with __reduce__ returning os.system('id')
+        decoded = base64.b64decode(session_data)
+        session = pickle.loads(decoded)
+        return jsonify({"user": session.get("user"), "role": session.get("role")})
+    except Exception as e:
+        return jsonify({"error": "Invalid session"}), 400
+
+
+@app.route("/cache/get", methods=["POST"])
+def get_cached():
+    raw = request.get_json().get("data", "")
+    # Data from Redis — but Redis can be poisoned by attacker
+    obj = pickle.loads(base64.b64decode(raw))
+    return jsonify({"value": str(obj)})

package/dist/packages/crucible/seeds/python/seed-048 3.py

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.loads used with untrusted data — arbitrary code execution
+
+import pickle
+import base64
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/session/restore", methods=["POST"])
+def restore_session():
+    session_data = request.cookies.get("session", "")
+    if not session_data:
+        return jsonify({"error": "No session"}), 401
+
+    try:
+        # pickle.loads executes arbitrary Python code embedded in the payload
+        # Attacker payload: object with __reduce__ returning os.system('id')
+        decoded = base64.b64decode(session_data)
+        session = pickle.loads(decoded)
+        return jsonify({"user": session.get("user"), "role": session.get("role")})
+    except Exception as e:
+        return jsonify({"error": "Invalid session"}), 400
+
+
+@app.route("/cache/get", methods=["POST"])
+def get_cached():
+    raw = request.get_json().get("data", "")
+    # Data from Redis — but Redis can be poisoned by attacker
+    obj = pickle.loads(base64.b64decode(raw))
+    return jsonify({"value": str(obj)})

package/dist/packages/crucible/seeds/python/seed-048.py

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.loads used with untrusted data — arbitrary code execution
+
+import pickle
+import base64
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/session/restore", methods=["POST"])
+def restore_session():
+    session_data = request.cookies.get("session", "")
+    if not session_data:
+        return jsonify({"error": "No session"}), 401
+
+    try:
+        # pickle.loads executes arbitrary Python code embedded in the payload
+        # Attacker payload: object with __reduce__ returning os.system('id')
+        decoded = base64.b64decode(session_data)
+        session = pickle.loads(decoded)
+        return jsonify({"user": session.get("user"), "role": session.get("role")})
+    except Exception as e:
+        return jsonify({"error": "Invalid session"}), 400
+
+
+@app.route("/cache/get", methods=["POST"])
+def get_cached():
+    raw = request.get_json().get("data", "")
+    # Data from Redis — but Redis can be poisoned by attacker
+    obj = pickle.loads(base64.b64decode(raw))
+    return jsonify({"value": str(obj)})

package/dist/packages/crucible/seeds/python/seed-049 2.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
+
+import pickle
+import shelve
+from fastapi import FastAPI, UploadFile, File, HTTPException
+
+app = FastAPI()
+
+
+@app.post("/models/load")
+async def load_model(file: UploadFile = File(...)):
+    contents = await file.read()
+    try:
+        # User-uploaded .pkl file deserialized without any validation
+        model = pickle.loads(contents)
+        return {"model_type": type(model).__name__}
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@app.get("/cache/{key}")
+def get_from_cache(key: str):
+    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
+    with shelve.open("/var/cache/app_cache") as db:
+        if key not in db:
+            raise HTTPException(status_code=404, detail="Not found")
+        value = db[key]  # deserialized via pickle
+    return {"value": value}
+
+
+@app.post("/tasks/restore")
+async def restore_task_state(file: UploadFile = File(...)):
+    data = await file.read()
+    state = pickle.loads(data)  # untrusted task state from client
+    return {"task_id": state.get("id"), "status": state.get("status")}

package/dist/packages/crucible/seeds/python/seed-049 3.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
+
+import pickle
+import shelve
+from fastapi import FastAPI, UploadFile, File, HTTPException
+
+app = FastAPI()
+
+
+@app.post("/models/load")
+async def load_model(file: UploadFile = File(...)):
+    contents = await file.read()
+    try:
+        # User-uploaded .pkl file deserialized without any validation
+        model = pickle.loads(contents)
+        return {"model_type": type(model).__name__}
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@app.get("/cache/{key}")
+def get_from_cache(key: str):
+    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
+    with shelve.open("/var/cache/app_cache") as db:
+        if key not in db:
+            raise HTTPException(status_code=404, detail="Not found")
+        value = db[key]  # deserialized via pickle
+    return {"value": value}
+
+
+@app.post("/tasks/restore")
+async def restore_task_state(file: UploadFile = File(...)):
+    data = await file.read()
+    state = pickle.loads(data)  # untrusted task state from client
+    return {"task_id": state.get("id"), "status": state.get("status")}

package/dist/packages/crucible/seeds/python/seed-049.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
+
+import pickle
+import shelve
+from fastapi import FastAPI, UploadFile, File, HTTPException
+
+app = FastAPI()
+
+
+@app.post("/models/load")
+async def load_model(file: UploadFile = File(...)):
+    contents = await file.read()
+    try:
+        # User-uploaded .pkl file deserialized without any validation
+        model = pickle.loads(contents)
+        return {"model_type": type(model).__name__}
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@app.get("/cache/{key}")
+def get_from_cache(key: str):
+    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
+    with shelve.open("/var/cache/app_cache") as db:
+        if key not in db:
+            raise HTTPException(status_code=404, detail="Not found")
+        value = db[key]  # deserialized via pickle
+    return {"value": value}
+
+
+@app.post("/tasks/restore")
+async def restore_task_state(file: UploadFile = File(...)):
+    data = await file.read()
+    state = pickle.loads(data)  # untrusted task state from client
+    return {"task_id": state.get("id"), "status": state.get("status")}

package/dist/packages/crucible/seeds/python/seed-050 2.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: high
+# language: python
+# expected: marshal.loads and jsonpickle.decode used with untrusted data
+
+import marshal
+import jsonpickle
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.post("/code/load")
+def load_code():
+    """Load a compiled Python code object from client."""
+    data = request.get_data()
+    # marshal.loads with user data can reconstruct code objects — arbitrary execution
+    code_obj = marshal.loads(data)
+    result = eval(code_obj)
+    return jsonify({"result": str(result)})
+
+
+@app.post("/object/restore")
+def restore_object():
+    payload = request.get_json()
+    serialized = payload.get("object", "")
+    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
+    obj = jsonpickle.decode(serialized)
+    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
+
+
+@app.post("/state/import")
+def import_state():
+    body = request.get_json()
+    state_json = body.get("state", "null")
+    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
+    state = jsonpickle.decode(state_json, classes=None)
+    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})

package/dist/packages/crucible/seeds/python/seed-050 3.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: high
+# language: python
+# expected: marshal.loads and jsonpickle.decode used with untrusted data
+
+import marshal
+import jsonpickle
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.post("/code/load")
+def load_code():
+    """Load a compiled Python code object from client."""
+    data = request.get_data()
+    # marshal.loads with user data can reconstruct code objects — arbitrary execution
+    code_obj = marshal.loads(data)
+    result = eval(code_obj)
+    return jsonify({"result": str(result)})
+
+
+@app.post("/object/restore")
+def restore_object():
+    payload = request.get_json()
+    serialized = payload.get("object", "")
+    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
+    obj = jsonpickle.decode(serialized)
+    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
+
+
+@app.post("/state/import")
+def import_state():
+    body = request.get_json()
+    state_json = body.get("state", "null")
+    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
+    state = jsonpickle.decode(state_json, classes=None)
+    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})

package/dist/packages/crucible/seeds/python/seed-050.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: high
+# language: python
+# expected: marshal.loads and jsonpickle.decode used with untrusted data
+
+import marshal
+import jsonpickle
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.post("/code/load")
+def load_code():
+    """Load a compiled Python code object from client."""
+    data = request.get_data()
+    # marshal.loads with user data can reconstruct code objects — arbitrary execution
+    code_obj = marshal.loads(data)
+    result = eval(code_obj)
+    return jsonify({"result": str(result)})
+
+
+@app.post("/object/restore")
+def restore_object():
+    payload = request.get_json()
+    serialized = payload.get("object", "")
+    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
+    obj = jsonpickle.decode(serialized)
+    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
+
+
+@app.post("/state/import")
+def import_state():
+    body = request.get_json()
+    state_json = body.get("state", "null")
+    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
+    state = jsonpickle.decode(state_json, classes=None)
+    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})

package/dist/packages/crucible/seeds/python/seed-051 2.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: yaml_injection
+# severity: critical
+# language: python
+# expected: yaml.load() with untrusted input — arbitrary code execution via YAML deserialization
+
+import yaml
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/config/upload", methods=["POST"])
+def upload_config():
+    raw_yaml = request.data.decode("utf-8")
+    # yaml.load without Loader= defaults to full deserialization — RCE possible
+    # Attacker payload: "!!python/object/apply:os.system ['id']"
+    config = yaml.load(raw_yaml)
+    return jsonify({"loaded_keys": list(config.keys()) if isinstance(config, dict) else []})
+
+
+@app.route("/workflow/import", methods=["POST"])
+def import_workflow():
+    yaml_content = request.get_json().get("yaml", "")
+    # yaml.load with untrusted string
+    workflow = yaml.load(yaml_content)
+    steps = workflow.get("steps", []) if isinstance(workflow, dict) else []
+    return jsonify({"steps": steps})
+
+
+@app.route("/settings/restore", methods=["POST"])
+def restore_settings():
+    uploaded = request.files.get("settings")
+    if not uploaded:
+        return jsonify({"error": "No file"}), 400
+    content = uploaded.read().decode("utf-8")
+    settings = yaml.load(content)  # unsafe loader
+    return jsonify({"restored": True, "settings": settings})

package/dist/packages/crucible/seeds/python/seed-051 3.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: yaml_injection
+# severity: critical
+# language: python
+# expected: yaml.load() with untrusted input — arbitrary code execution via YAML deserialization
+
+import yaml
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/config/upload", methods=["POST"])
+def upload_config():
+    raw_yaml = request.data.decode("utf-8")
+    # yaml.load without Loader= defaults to full deserialization — RCE possible
+    # Attacker payload: "!!python/object/apply:os.system ['id']"
+    config = yaml.load(raw_yaml)
+    return jsonify({"loaded_keys": list(config.keys()) if isinstance(config, dict) else []})
+
+
+@app.route("/workflow/import", methods=["POST"])
+def import_workflow():
+    yaml_content = request.get_json().get("yaml", "")
+    # yaml.load with untrusted string
+    workflow = yaml.load(yaml_content)
+    steps = workflow.get("steps", []) if isinstance(workflow, dict) else []
+    return jsonify({"steps": steps})
+
+
+@app.route("/settings/restore", methods=["POST"])
+def restore_settings():
+    uploaded = request.files.get("settings")
+    if not uploaded:
+        return jsonify({"error": "No file"}), 400
+    content = uploaded.read().decode("utf-8")
+    settings = yaml.load(content)  # unsafe loader
+    return jsonify({"restored": True, "settings": settings})