CVE-2023-48699— fastbots 安全漏洞

fastbots Eval Injection vulnerability

fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function `def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.1.5 or above.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

动态执行代码中指令转义处理不恰当(Eval注入)

fastbots 安全漏洞

fastbots是一个使用 selenium 和 POM（页面对象模型）设计进行快速机器人和爬虫开发的简单库。 fastbots 0.1.5之前版本存在安全漏洞，该漏洞源于 page.py 中的def locator(self, locator_name: str) 函数中存在指令的不正确中和，攻击者利用该漏洞可以使用 python 代码修改 locators.ini 定位器文件，未经适当验证就会执行该文件，导致RCE。

N/A

N/A