nltk WekaClassifier路径遍历绕过pathsec沙箱（GHSA-j456-xh4h-cp2f）

WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment 漏洞概述 漏洞名称: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment 漏洞ID: GHSA-j456-xh4h-cp2f 严重程度: High CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: High - Availability: Low CVSS v3 score: 8.8 / 10 CVE ID: No known CVE Weaknesses: CWE-22, CWE-73 Credits: manus-use (Reporter) 影响范围 受影响版本: <= 3.10.3 修复版本: None 修复方案 建议修复: Before building the / / command, validate the model path with pathsec, mirroring CRFTagger / MaxParser: Proof of Concept Attack Chain 1. Entry: Action: an app running with lets an untrusted workflow choose the weka model path and calls (read). Guard: none — plain classmethod/constructor parameter (weka.py:230,108-110). Bypass proof: grep shows weka.py uses no validate_tool_path / validate_model_resource. 2. Command build: Action: the path is placed into (weka.py:256) / . Guard: only the internally-generated train.arff is staged via make_staging_dir; the model path is passed as-is. Bypass proof: runtime capture yielded — the raw out-of-root path is . 3. Java() sink: Action: (internals.py:431). Guard: validates classpath/JVM options, and rejects tokens. Bypass proof: none of these inspect the / program-arg value; internals.py explicitly documents that program args after the main class may start with , and the path is neither nor an -token, so every gate passes. Negative control: the same path through raises . 4. Impact: Action: the weka JVM opens the path outside the allowed roots — arbitrary-location write ( ) / parse-existence oracle ( ). Guard: pathsec is never consulted (no validate_tool_path, no pathsec.open). Bypass proof: the directly-analogous sibling CRFTagger.train calls validate_tool_path(model_file, must_exist=False) (CRF300); weka does not, and commit hardened weka's other sinks (scratch files, WEKAHOME jar) while leaving the model path unvalidated. Bypass Evidence Negative control (guard is read): → → → Sink reached unvalidated (guard absent): captured write-side arg and read-side . Version: git show v3.10.3:nltk/classify/weka.py contains both the model-path build (line 235) and the read, and NO validate_tool_path. Affected Versions <= 3.10.3 (present on the latest release tag v3.10.3 and on HEAD @ee6d6134). No published fix has ever targeted the weka / model path; commits after v3.10.3 @ee6d6138, @2adaaaf, @9752559 touched weka.py for other sinks but did not add model-path validation. Fix status (2026-09-28) Status: MERGED on develop (unreleased; v3.10.3 of 2026-08-12 predates the fix). PR: #3563 "Bound the WekaClassifier model path to the pathsec data roots", merged 2026-09-06, merge commit 8c2f787 on develop. Fix commit: 8a1769e. Probe: nltk/test/unit/security_probe/ghsa_j456_xh4h_cp2f.py, added by PR #3563 "Add GHSA-j456 live probe, expand the GHSA-8m9g probe attack set" (commit a0f132), merged 2026-09-20, merge commit 8a897b; verdict on develop: 2fa748: FIXED (WekaClassifier -i and -d refuse out-of-root model paths). Release: none yet; no release tag contains 8a1769e.

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

nltk WekaClassifier路径遍历绕过pathsec沙箱（GHSA-j456-xh4h-cp2f）

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

nltk WekaClassifier路径遍历绕过pathsec沙箱（GHSA-j456-xh4h-cp2f）

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！