thuban 0.3.4 → 0.4.1

package/dist/packages/crucible/seeds/python/seed-038.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: MD5 used for file integrity and RSA with insufficient key size
+
+import hashlib
+from Crypto.PublicKey import RSA
+from Crypto.Signature import pkcs1_15
+from Crypto.Hash import MD5
+
+
+def checksum_file(filepath: str) -> str:
+    # MD5 is collision-prone — not suitable for integrity verification
+    with open(filepath, "rb") as f:
+        return hashlib.md5(f.read()).hexdigest()
+
+
+def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
+    return checksum_file(filepath) == expected_md5
+
+
+def generate_rsa_keypair():
+    # 512-bit RSA key — trivially factorable in seconds
+    key = RSA.generate(512)
+    return key.export_key().decode(), key.publickey().export_key().decode()
+
+
+def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
+    key = RSA.import_key(private_key_pem)
+    # MD5 with RSA — known-weak combination
+    h = MD5.new(message)
+    return pkcs1_15.new(key).sign(h)

package/dist/packages/crucible/seeds/python/seed-039 2.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval() called with user-controlled expression string
+
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/calculate", methods=["POST"])
+def calculate():
+    data = request.get_json()
+    expression = data.get("expression", "")
+    try:
+        # Attacker sends: "__import__('os').system('id')"
+        result = eval(expression)
+        return jsonify({"result": result})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/filter", methods=["POST"])
+def filter_data():
+    data = request.get_json()
+    records = data.get("records", [])
+    condition = data.get("condition", "True")
+    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
+    filtered = [r for r in records if eval(condition, {"r": r})]
+    return jsonify({"results": filtered})
+
+
+@app.route("/transform", methods=["POST"])
+def transform():
+    expr = request.get_json().get("expr", "x")
+    items = request.get_json().get("items", [1, 2, 3])
+    result = list(map(lambda x: eval(expr), items))
+    return jsonify({"result": result})

package/dist/packages/crucible/seeds/python/seed-039.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval() called with user-controlled expression string
+
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/calculate", methods=["POST"])
+def calculate():
+    data = request.get_json()
+    expression = data.get("expression", "")
+    try:
+        # Attacker sends: "__import__('os').system('id')"
+        result = eval(expression)
+        return jsonify({"result": result})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/filter", methods=["POST"])
+def filter_data():
+    data = request.get_json()
+    records = data.get("records", [])
+    condition = data.get("condition", "True")
+    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
+    filtered = [r for r in records if eval(condition, {"r": r})]
+    return jsonify({"results": filtered})
+
+
+@app.route("/transform", methods=["POST"])
+def transform():
+    expr = request.get_json().get("expr", "x")
+    items = request.get_json().get("items", [1, 2, 3])
+    result = list(map(lambda x: eval(expr), items))
+    return jsonify({"result": result})

package/dist/packages/crucible/seeds/python/seed-040 2.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: exec() called with user-controlled code string
+
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/scripting/run", methods=["POST"])
+def run_script():
+    data = request.get_json()
+    code = data.get("code", "")
+    context = data.get("context", {})
+    local_vars = {"result": None, **context}
+    try:
+        # exec() executes arbitrary Python — no sandboxing
+        exec(code, {"__builtins__": __builtins__}, local_vars)
+        return jsonify({"result": local_vars.get("result")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/hooks/execute", methods=["POST"])
+def execute_hook():
+    hook_code = request.get_json().get("hook", "")
+    event = request.get_json().get("event", {})
+    # User-controlled hook code executed server-side
+    exec(hook_code, {"event": event, "print": print})
+    return jsonify({"executed": True})
+
+
+@app.route("/migration/run", methods=["POST"])
+def run_migration():
+    migration_script = request.get_json().get("script", "")
+    exec(compile(migration_script, "<migration>", "exec"))
+    return jsonify({"status": "done"})

package/dist/packages/crucible/seeds/python/seed-040.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: exec() called with user-controlled code string
+
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/scripting/run", methods=["POST"])
+def run_script():
+    data = request.get_json()
+    code = data.get("code", "")
+    context = data.get("context", {})
+    local_vars = {"result": None, **context}
+    try:
+        # exec() executes arbitrary Python — no sandboxing
+        exec(code, {"__builtins__": __builtins__}, local_vars)
+        return jsonify({"result": local_vars.get("result")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/hooks/execute", methods=["POST"])
+def execute_hook():
+    hook_code = request.get_json().get("hook", "")
+    event = request.get_json().get("event", {})
+    # User-controlled hook code executed server-side
+    exec(hook_code, {"event": event, "print": print})
+    return jsonify({"executed": True})
+
+
+@app.route("/migration/run", methods=["POST"])
+def run_migration():
+    migration_script = request.get_json().get("script", "")
+    exec(compile(migration_script, "<migration>", "exec"))
+    return jsonify({"status": "done"})

package/dist/packages/crucible/seeds/python/seed-041 2.py

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() used in Jinja2-like custom template rendering with user template string
+
+import re
+from flask import Flask, request
+
+app = Flask(__name__)
+
+
+def render_template(template: str, context: dict) -> str:
+    """Simple template renderer that evaluates {{ expr }} blocks."""
+    def evaluate(match):
+        expr = match.group(1).strip()
+        # eval with user-controlled expression — attacker injects arbitrary Python
+        return str(eval(expr, {"__builtins__": {}}, context))
+
+    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
+
+
+@app.route("/preview", methods=["POST"])
+def preview():
+    data = request.get_json()
+    template = data.get("template", "Hello {{ name }}!")
+    ctx = data.get("context", {"name": "World"})
+    # Attacker template: "{{ __import__('os').system('id') }}"
+    output = render_template(template, ctx)
+    return output
+
+
+@app.route("/report", methods=["POST"])
+def report():
+    tpl = request.form.get("template", "")
+    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
+    return rendered

package/dist/packages/crucible/seeds/python/seed-041.py

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() used in Jinja2-like custom template rendering with user template string
+
+import re
+from flask import Flask, request
+
+app = Flask(__name__)
+
+
+def render_template(template: str, context: dict) -> str:
+    """Simple template renderer that evaluates {{ expr }} blocks."""
+    def evaluate(match):
+        expr = match.group(1).strip()
+        # eval with user-controlled expression — attacker injects arbitrary Python
+        return str(eval(expr, {"__builtins__": {}}, context))
+
+    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
+
+
+@app.route("/preview", methods=["POST"])
+def preview():
+    data = request.get_json()
+    template = data.get("template", "Hello {{ name }}!")
+    ctx = data.get("context", {"name": "World"})
+    # Attacker template: "{{ __import__('os').system('id') }}"
+    output = render_template(template, ctx)
+    return output
+
+
+@app.route("/report", methods=["POST"])
+def report():
+    tpl = request.form.get("template", "")
+    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
+    return rendered

package/dist/packages/crucible/seeds/python/seed-042 2.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() in pandas query/eval with user-controlled expression
+
+import pandas as pd
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+# Simulated data store
+DATA = pd.DataFrame({
+    "id": range(1, 101),
+    "amount": [i * 10.5 for i in range(1, 101)],
+    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
+    "active": [True] * 100,
+})
+
+
+@app.route("/data/query", methods=["POST"])
+def query_data():
+    body = request.get_json()
+    filter_expr = body.get("filter", "active == True")
+    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
+    # Attacker: "@__import__('os').system('id')"
+    try:
+        result = DATA.query(filter_expr)
+        return jsonify({"count": len(result), "data": result.to_dict("records")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/data/eval", methods=["POST"])
+def eval_expression():
+    expr = request.get_json().get("expr", "amount * 2")
+    result = DATA.eval(expr)
+    return jsonify({"result": result.tolist()})

package/dist/packages/crucible/seeds/python/seed-042.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() in pandas query/eval with user-controlled expression
+
+import pandas as pd
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+# Simulated data store
+DATA = pd.DataFrame({
+    "id": range(1, 101),
+    "amount": [i * 10.5 for i in range(1, 101)],
+    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
+    "active": [True] * 100,
+})
+
+
+@app.route("/data/query", methods=["POST"])
+def query_data():
+    body = request.get_json()
+    filter_expr = body.get("filter", "active == True")
+    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
+    # Attacker: "@__import__('os').system('id')"
+    try:
+        result = DATA.query(filter_expr)
+        return jsonify({"count": len(result), "data": result.to_dict("records")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/data/eval", methods=["POST"])
+def eval_expression():
+    expr = request.get_json().get("expr", "amount * 2")
+    result = DATA.eval(expr)
+    return jsonify({"result": result.tolist()})

package/dist/packages/crucible/seeds/python/seed-043 2.py

@@ -0,0 +1,32 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval()/compile() used to execute user-uploaded Python module code
+
+import ast
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def safe_eval(code: str, context: dict) -> object:
+    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
+    try:
+        tree = ast.parse(code, mode="eval")
+        # compile() + eval() of user AST still allows dangerous constructs
+        compiled = compile(tree, "<user-input>", "eval")
+        return eval(compiled, {"__builtins__": __builtins__}, context)
+    except SyntaxError:
+        # Falls back to exec for multi-line code
+        exec(compile(code, "<user-input>", "exec"), context)
+        return context.get("result")
+
+
+@app.route("/plugin/evaluate", methods=["POST"])
+def evaluate_plugin():
+    payload = request.get_json()
+    code = payload.get("code", "")
+    params = payload.get("params", {})
+    result = safe_eval(code, params)
+    return jsonify({"output": result})

package/dist/packages/crucible/seeds/python/seed-043.py

@@ -0,0 +1,32 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval()/compile() used to execute user-uploaded Python module code
+
+import ast
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def safe_eval(code: str, context: dict) -> object:
+    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
+    try:
+        tree = ast.parse(code, mode="eval")
+        # compile() + eval() of user AST still allows dangerous constructs
+        compiled = compile(tree, "<user-input>", "eval")
+        return eval(compiled, {"__builtins__": __builtins__}, context)
+    except SyntaxError:
+        # Falls back to exec for multi-line code
+        exec(compile(code, "<user-input>", "exec"), context)
+        return context.get("result")
+
+
+@app.route("/plugin/evaluate", methods=["POST"])
+def evaluate_plugin():
+    payload = request.get_json()
+    code = payload.get("code", "")
+    params = payload.get("params", {})
+    result = safe_eval(code, params)
+    return jsonify({"output": result})

package/dist/packages/crucible/seeds/python/seed-044 2.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via requests.get with unvalidated user-supplied URL
+
+import requests
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/proxy")
+def proxy():
+    target_url = request.args.get("url", "")
+    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
+    response = requests.get(target_url, timeout=10)
+    return jsonify({
+        "status": response.status_code,
+        "content": response.text[:2000],
+    })
+
+
+@app.route("/webhook/test", methods=["POST"])
+def test_webhook():
+    data = request.get_json()
+    webhook_url = data.get("url", "")
+    payload = data.get("payload", {})
+    # webhook_url from user — attacker targets internal services
+    resp = requests.post(webhook_url, json=payload, timeout=8)
+    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
+
+
+@app.route("/avatar/fetch")
+def fetch_avatar():
+    avatar_url = request.args.get("url", "")
+    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
+    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-044.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via requests.get with unvalidated user-supplied URL
+
+import requests
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/proxy")
+def proxy():
+    target_url = request.args.get("url", "")
+    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
+    response = requests.get(target_url, timeout=10)
+    return jsonify({
+        "status": response.status_code,
+        "content": response.text[:2000],
+    })
+
+
+@app.route("/webhook/test", methods=["POST"])
+def test_webhook():
+    data = request.get_json()
+    webhook_url = data.get("url", "")
+    payload = data.get("payload", {})
+    # webhook_url from user — attacker targets internal services
+    resp = requests.post(webhook_url, json=payload, timeout=8)
+    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
+
+
+@app.route("/avatar/fetch")
+def fetch_avatar():
+    avatar_url = request.args.get("url", "")
+    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
+    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-045 2.py

@@ -0,0 +1,36 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via httpx.get with user-controlled URL and redirect following
+
+import httpx
+from fastapi import FastAPI, Query
+from fastapi.responses import JSONResponse
+
+app = FastAPI()
+
+
+@app.get("/import/data")
+async def import_data(source: str = Query(...)):
+    # source from user — can be internal URL or cloud metadata endpoint
+    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
+        resp = await client.get(source)
+        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
+
+
+@app.post("/oembed")
+async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
+    # provider is an oembed endpoint from user — SSRF to internal services
+    oembed_url = f"{provider}?url={url}&format=json"
+    async with httpx.AsyncClient(timeout=8.0) as client:
+        resp = await client.get(oembed_url)
+        return resp.json()
+
+
+@app.get("/link-preview")
+async def link_preview(target: str = Query(...)):
+    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
+        resp = await client.get(target)
+    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
+    return {"title": title, "url": target}

package/dist/packages/crucible/seeds/python/seed-045.py

@@ -0,0 +1,36 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via httpx.get with user-controlled URL and redirect following
+
+import httpx
+from fastapi import FastAPI, Query
+from fastapi.responses import JSONResponse
+
+app = FastAPI()
+
+
+@app.get("/import/data")
+async def import_data(source: str = Query(...)):
+    # source from user — can be internal URL or cloud metadata endpoint
+    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
+        resp = await client.get(source)
+        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
+
+
+@app.post("/oembed")
+async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
+    # provider is an oembed endpoint from user — SSRF to internal services
+    oembed_url = f"{provider}?url={url}&format=json"
+    async with httpx.AsyncClient(timeout=8.0) as client:
+        resp = await client.get(oembed_url)
+        return resp.json()
+
+
+@app.get("/link-preview")
+async def link_preview(target: str = Query(...)):
+    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
+        resp = await client.get(target)
+    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
+    return {"title": title, "url": target}

package/dist/packages/crucible/seeds/python/seed-046 2.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via urllib.request.urlopen with unvalidated user URL
+
+import urllib.request
+import urllib.parse
+from django.http import JsonResponse
+
+
+def fetch_remote_resource(request):
+    """Fetch an external resource on behalf of the client."""
+    url = request.GET.get("url", "")
+
+    # No validation — internal URLs, file://, gopher:// etc. all accepted
+    try:
+        with urllib.request.urlopen(url, timeout=10) as response:
+            content = response.read(4096).decode("utf-8", errors="replace")
+            content_type = response.headers.get("Content-Type", "")
+        return JsonResponse({"content": content, "content_type": content_type})
+    except Exception as e:
+        return JsonResponse({"error": str(e)}, status=400)
+
+
+def check_url_status(request):
+    target = request.POST.get("target", "")
+    try:
+        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return JsonResponse({"status": resp.status, "url": target})
+    except urllib.error.HTTPError as e:
+        return JsonResponse({"status": e.code})

package/dist/packages/crucible/seeds/python/seed-046.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via urllib.request.urlopen with unvalidated user URL
+
+import urllib.request
+import urllib.parse
+from django.http import JsonResponse
+
+
+def fetch_remote_resource(request):
+    """Fetch an external resource on behalf of the client."""
+    url = request.GET.get("url", "")
+
+    # No validation — internal URLs, file://, gopher:// etc. all accepted
+    try:
+        with urllib.request.urlopen(url, timeout=10) as response:
+            content = response.read(4096).decode("utf-8", errors="replace")
+            content_type = response.headers.get("Content-Type", "")
+        return JsonResponse({"content": content, "content_type": content_type})
+    except Exception as e:
+        return JsonResponse({"error": str(e)}, status=400)
+
+
+def check_url_status(request):
+    target = request.POST.get("target", "")
+    try:
+        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return JsonResponse({"status": resp.status, "url": target})
+    except urllib.error.HTTPError as e:
+        return JsonResponse({"status": e.code})