Unexpected Execution: Wild Ways Code Execution can Occur in Python
summary
Title promises surprises and delivers specifics: concrete exploits, numbers, and fixes. Shows pickle deserialization creating exec payloads, input() in Python 2 evaluated via eval, import hijacks by writing modules or poisoning sys.path, and template RCEs via engines like Jinja calling subprocess.Popen. Demos live at github.com/gbleaney/python_security, CVE‑2021‑3177 and typing get_type_hints quirks appear, and Pysa/static analysis is the practical mitigation used to find and prevent these vectors.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:03Remote Command Execution
- 2:53Why Do You Care about Rce
- 6:13Demo
- 6:40Exploit Help
- 8:07Prevent Rce through Deserialization
- 8:31Input Function in Python
- 9:44The Exploit Generation
- 10:58Rpc Framework
- 17:01String Formatting
related talks
26mTesting Python Security
59mCommon Python Coding Mistakes
50mWhen Arbitrary Code Execution is Working As Intended What Code is Python Supposed To Execute
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
45mPython common security mistakes in 2022
43mUnique ways to Hack into a Python Web Service
25mMischief Managed: What hackers can do on your Jupyter instance
51mPrompt Injection: When Hackers Befriend Your AI