Semgrep Registry - python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use

Detected subprocess function with argument tainted by event object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.

Defintion

Open in Playground

rules:
  - id: dangerous-subprocess-use
    mode: taint
    message: Detected subprocess function with argument tainted by `event` object.
      If this data can be controlled by a malicious actor, it may be an instance
      of command injection. Audit the use of this call to ensure it is not
      controllable by an external resource. You may consider using
      'shlex.escape()'.
    metadata:
      owasp:
        - A01:2017 - Injection
        - A03:2021 - Injection
      cwe:
        - "CWE-78: Improper Neutralization of Special Elements used in an OS
          Command ('OS Command Injection')"
      asvs:
        section: "V5: Validation, Sanitization and Encoding Verification Requirements"
        control_id: 5.3.8 OS Command Injection
        control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
        version: "4"
      references:
        - https://docs.python.org/3/library/subprocess.html
        - https://docs.python.org/3/library/shlex.html
      category: security
      technology:
        - python
        - aws-lambda
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - vuln
      likelihood: HIGH
      impact: MEDIUM
      confidence: MEDIUM
    languages:
      - python
    severity: ERROR
    pattern-sources:
      - patterns:
          - pattern: event
          - pattern-inside: |
              def $HANDLER(event, context):
                ...
    pattern-sinks:
      - patterns:
          - pattern: $CMD
          - pattern-either:
              - pattern-inside: subprocess.$FUNC($CMD, ...)
              - pattern-inside: subprocess.$FUNC([$CMD,...], ...)
              - pattern-inside: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD,
                  ...)
              - pattern-inside: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD,
                  ...], ...)
              - pattern-inside: subprocess.$FUNC("=~/(python)/", $CMD, ...)
              - pattern-inside: subprocess.$FUNC(["=~/(python)/",$CMD,...],...)
    pattern-sanitizers:
      - pattern: shlex.escape(...)

import subprocess import sys def handler(event, context): # ok:dangerous-subprocess-use subprocess.call("echo 'hello'") # ok:dangerous-subprocess-use subprocess.call(["echo", "a", ";", "rm", "-rf", "/"]) # ruleid:dangerous-subprocess-use subprocess.call("grep -R {} .".format(event['id'])) cmd = event['id'].split() # ruleid:dangerous-subprocess-use subprocess.call([cmd[0], cmd[1], "some", "args"]) # ruleid:dangerous-subprocess-use subprocess.call("grep -R {} .".format(event['id']), shell=True) # ruleid:dangerous-subprocess-use subprocess.call("grep -R {} .".format(event['id']), shell=True, cwd="/home/user") # ruleid:dangerous-subprocess-use subprocess.run("grep -R {} .".format(event['id']), shell=True) # ruleid:dangerous-subprocess-use subprocess.run(["bash", "-c", event['id']], shell=True) python_file = f""" print("What is your name?") name = input() print("Hello " + {event['id']}) """ # ruleid:dangerous-subprocess-use program = subprocess.Popen(['python2', python_file], stdin=subprocess.PIPE, text=True) program.communicate(input=payload, timeout=1)

python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use

Run Locally

Run in CI

Defintion

Examples

dangerous-subprocess-use.py