ubertidavide fastbots up to 0.1.4 Page Object Model locators.ini __locator__ eval injection

Summaryinfo

A vulnerability described as problematic has been identified in ubertidavide fastbots up to 0.1.4. This impacts the function __locator__ of the file locators.ini of the component Page Object Model. Such manipulation leads to eval injection. This vulnerability is documented as CVE-2023-48699. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in ubertidavide fastbots up to 0.1.4. Affected by this issue is the function __locator__ of the file locators.ini of the component Page Object Model. The manipulation with an unknown input leads to a eval injection vulnerability. Using CWE to declare the problem leads to CWE-95. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). Impacted is confidentiality, integrity, and availability. CVE summarizes:

fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function `def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.1.5 or above.

The weakness was released 11/22/2023 as GHSA-vccg-f4gp-45x9. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-48699 since 11/17/2023. There are known technical details, but no exploit is available.

By approaching the search of inurl:locators.ini it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.1.5 eliminates this vulnerability. Applying the patch 73eb03bd75365e112b39877e26ef52853f5e9f57 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• ubertidavide

Name

• fastbots

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3
• 0.1.4

License

• open-source

Website

• Product: https://github.com/ubertidavide/fastbots/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion