135 lines
3.0 KiB
Python
135 lines
3.0 KiB
Python
|
"""
|
|||
|
|
竞态条件漏洞知识
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
from ..base import KnowledgeDocument, KnowledgeCategory
|
|||
|
|
|
|||
|
|
|
|||
|
|
RACE_CONDITION = KnowledgeDocument(
|
|||
|
|
id="vuln_race_condition",
|
|||
|
|
title="Race Condition",
|
|||
|
|
category=KnowledgeCategory.VULNERABILITY,
|
|||
|
|
tags=["race", "condition", "toctou", "concurrency", "thread"],
|
|||
|
|
severity="medium",
|
|||
|
|
cwe_ids=["CWE-362", "CWE-367"],
|
|||
|
|
owasp_ids=["A04:2021"],
|
|||
|
|
content="""
|
|||
|
|
竞态条件发生在多个操作之间存在时间窗口，攻击者可以利用这个窗口改变系统状态。
|
|||
|
|
|
|||
|
|
## 危险模式
|
|||
|
|
|
|||
|
|
### TOCTOU (Time-of-Check to Time-of-Use)
|
|||
|
|
```python
|
|||
|
|
# 危险 - 检查和使用之间有时间窗口
|
|||
|
|
if os.path.exists(filepath): # 检查
|
|||
|
|
# 攻击者可在此时替换文件
|
|||
|
|
with open(filepath) as f: # 使用
|
|||
|
|
data = f.read()
|
|||
|
|
|
|||
|
|
# 危险 - 余额检查
|
|||
|
|
if user.balance >= amount: # 检查
|
|||
|
|
# 并发请求可能同时通过检查
|
|||
|
|
user.balance -= amount # 使用
|
|||
|
|
db.commit()
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 双重支付/提现
|
|||
|
|
```python
|
|||
|
|
# 危险 - 无锁的余额操作
|
|||
|
|
@app.route('/withdraw', methods=['POST'])
|
|||
|
|
def withdraw():
|
|||
|
|
amount = request.json['amount']
|
|||
|
|
if current_user.balance >= amount:
|
|||
|
|
current_user.balance -= amount
|
|||
|
|
db.commit()
|
|||
|
|
return transfer_money(amount)
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 文件操作竞态
|
|||
|
|
```python
|
|||
|
|
# 危险 - 临时文件
|
|||
|
|
import tempfile
|
|||
|
|
fd, path = tempfile.mkstemp()
|
|||
|
|
# 攻击者可能在此时访问或替换文件
|
|||
|
|
os.chmod(path, 0o644)
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 会话竞态
|
|||
|
|
```python
|
|||
|
|
# 危险 - 会话更新
|
|||
|
|
session['cart_total'] = calculate_total()
|
|||
|
|
# 并发请求可能覆盖
|
|||
|
|
apply_discount(session['cart_total'])
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 检测要点
|
|||
|
|
1. 检查-使用模式（if exists then use）
|
|||
|
|
2. 余额/库存等数值操作
|
|||
|
|
3. 文件创建和权限设置
|
|||
|
|
4. 无锁的数据库操作
|
|||
|
|
5. 会话状态修改
|
|||
|
|
|
|||
|
|
## 安全实践
|
|||
|
|
1. 使用数据库事务和锁
|
|||
|
|
2. 原子操作
|
|||
|
|
3. 使用文件锁
|
|||
|
|
4. 乐观锁/悲观锁
|
|||
|
|
5. 幂等性设计
|
|||
|
|
|
|||
|
|
## 修复示例
|
|||
|
|
|
|||
|
|
### 数据库锁
|
|||
|
|
```python
|
|||
|
|
# 安全 - 使用SELECT FOR UPDATE
|
|||
|
|
from sqlalchemy import select
|
|||
|
|
|
|||
|
|
@app.route('/withdraw', methods=['POST'])
|
|||
|
|
def withdraw():
|
|||
|
|
amount = request.json['amount']
|
|||
|
|
|
|||
|
|
with db.begin():
|
|||
|
|
# 行级锁
|
|||
|
|
user = db.execute(
|
|||
|
|
select(User).where(User.id == current_user.id).with_for_update()
|
|||
|
|
).scalar_one()
|
|||
|
|
|
|||
|
|
if user.balance >= amount:
|
|||
|
|
user.balance -= amount
|
|||
|
|
return transfer_money(amount)
|
|||
|
|
else:
|
|||
|
|
return "Insufficient balance", 400
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 原子操作
|
|||
|
|
```python
|
|||
|
|
# 安全 - 原子更新
|
|||
|
|
from sqlalchemy import update
|
|||
|
|
|
|||
|
|
result = db.execute(
|
|||
|
|
update(User)
|
|||
|
|
.where(User.id == user_id)
|
|||
|
|
.where(User.balance >= amount) # 条件更新
|
|||
|
|
.values(balance=User.balance - amount)
|
|||
|
|
)
|
|||
|
|
if result.rowcount == 0:
|
|||
|
|
return "Insufficient balance", 400
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 文件锁
|
|||
|
|
```python
|
|||
|
|
# 安全 - 使用文件锁
|
|||
|
|
import fcntl
|
|||
|
|
|
|||
|
|
with open(filepath, 'r+') as f:
|
|||
|
|
fcntl.flock(f.fileno(), fcntl.LOCK_EX)
|
|||
|
|
try:
|
|||
|
|
data = f.read()
|
|||
|
|
# 处理数据
|
|||
|
|
f.seek(0)
|
|||
|
|
f.write(new_data)
|
|||
|
|
finally:
|
|||
|
|
fcntl.flock(f.fileno(), fcntl.LOCK_UN)
|
|||
|
|
```
|
|||
|
|
""",
|
|||
|
|
)
|