George0Papasotiriou/CVE-2026-9999-Serverless-Event-Injection-to-Code-Overwrite
GitHub: George0Papasotiriou/CVE-2026-9999-Serverless-Event-Injection-to-Code-Overwrite
该项目模拟了一个存在路径遍历漏洞的 Serverless 函数运行时，用于演示事件注入导致代码覆盖及 RCE 的完整攻击链。
Stars: 0 | Forks: 0
## 3. CVE-2026-9999 – Serverless 函数事件注入（路径遍历 → 代码覆盖）
### 概述
一个处理对象存储事件的 Serverless 平台未对 `object.key` 字段进行过滤，允许攻击者通过路径遍历覆盖函数的源代码。
**严重程度：** 严重（下次调用时触发 RCE）
### 利用与模拟 (Python)
```
#!/usr/bin/env python3
"""
vulnerable_serverless.py - Simulated AWS Lambda-like runtime with event injection.
"""
import json, os, shutil, subprocess
from http.server import HTTPServer, BaseHTTPRequestHandler
FUNCTION_DIR = "/tmp/function"
os.makedirs(FUNCTION_DIR, exist_ok=True)
# 初始 function 代码
with open(os.path.join(FUNCTION_DIR, "handler.py"), "w") as f:
f.write("""
def handler(event):
return "Hello, " + event.get('name', 'world')
""")
class Handler(BaseHTTPRequestHandler):
def do_POST(self):
content_length = int(self.headers['Content-Length'])
body = self.rfile.read(content_length)
event = json.loads(body)
# Vulnerable: use event['key'] to decide which file to load?
# Simulate: the function source is overwritten by an "update" event from storage.
if event.get('source') == 'storage':
# Path traversal in object key
object_key = event['object']['key'] # attacker controlled
# Overwrite handler.py with the object content (simulated)
dst = os.path.join(FUNCTION_DIR, "handler.py")
# directory traversal to write outside? But we want to overwrite handler.py.
# Attack: object.key = "../../../tmp/function/handler.py"
# Normalize to ensure it's within FUNCTION_DIR? No validation!
# The "get object" would fetch the file; here we just write injected code.
injected_code = event.get('code', '# no code')
# Resolve the full path – this is the vulnerability:
full_path = os.path.normpath(os.path.join(FUNCTION_DIR, object_key))
# Only check if it is under FUNCTION_DIR? Not present.
with open(full_path, 'w') as f:
f.write(injected_code)
self.send_response(200)
self.end_headers()
self.wfile.write(b"Update applied")
else:
# Execute current handler (for demo)
import handler
result = handler.handler(event)
self.send_response(200)
self.end_headers()
self.wfile.write(result.encode())
server = HTTPServer(('0.0.0.0', 8000), Handler)
server.serve_forever()
```
# CVE-2026-9999 – Serverless 事件注入导致代码覆盖
## 📖 概述
Serverless 平台事件处理中的路径遍历漏洞允许攻击者覆盖函数的源代码，导致在后续调用时触发远程代码执行。
## ⚙️ 漏洞详情
- **类型：** 路径遍历 / 不安全的文件写入
- **影响：** 远程代码执行 (RCE)
- **根本原因：** 平台盲目信任来自存储事件的 `object.key` 字段且未进行过滤，导致可以使用 `../` 序列写入到函数 sandbox 内的任意路径。
## 🧪 利用演示
1. 启动存在漏洞的 runtime：
python vulnerable_serverless.py
标签：Homebrew安装, Python, Serverless, 代码执行, 无后门, 漏洞复现, 漏洞环境, 路径穿越, 逆向工具