Audit required: Starting a subprocess BAN-B606
Starting a process without a shell.
78 self.pid, self.fd = pty.fork()
79 if self.pid == 0:
80 setproctitle.setproctitle(f'{sys.argv[0]} terminal session #{os.getpid():d}')
81 os.execvpe(exe, args, env) 82
83 logging.info(f'Subprocess PID {self.pid}')
84Starting a process without a shell.
39 logging.warning('Will restart the process now')
40 if '-d' in sys.argv:
41 sys.argv.remove('-d')
42 os.execv(sys.argv[0], sys.argv) 43
44try:
45 # If Namespace is not provided, then the wrong socketio library is installed
Description
Spawning of a subprocess in a way that doesn't use a shell is generally safe, but it maybe useful for penetration testing workflows to track where external system calls are used.
Python possesses many mechanisms to invoke an external executable. However, doing so may present a security issue if appropriate care is not taken to sanitize any user provided or variable input.
import os
# Creating subprocess:
# The following calls can be sensitive if the command is not sanitized, since they are starting a subprocess.
os.spawnl(mode, path, *cmd)
os.spawnle(mode, path, *cmd, env)
os.spawnlp(mode, file, *cmd)
os.spawnlpe(mode, file, *cmd, env)
os.spawnv(mode, path, cmd)
References:
- OWASP Top 10 2021 Category A03 - Injection
- SANS Top 25
- CWE-78