Python Standard Library Gadgets for Upgrading Format String Exploits

No ratings

Presented at BSidesAugusta 2019 by

Brian Welch

There exists a class of vulnerabilities within the Python programming language which involve injection of an attacker-controlled format string. Exploits for these vulnerabilities can typically only achieve a read of the global Python namespace. However, this talk explores a series of gadgets within the Python standard library and popular community packages that can upgrade exploits relying on these attacker-controlled format strings to achieve arbitrary code execution and file system enumeration. This talk will discuss automated methods of finding these gadgets as well as techniques for mitigating their use.