PRP: D-tale Server exposed UI

[VickyTheViking]

Hi, This PR is according to the recent Issue #561

You can set up a secure and vulnerable instance here: google/security-testbeds#150

[tooryx]

Please provide a more precise description and recommendation to match the CVE.

[VickyTheViking]

@tooryx I updated the PRP to expose UI I tested the latest version of D-tale, and it is a feature actually( the code injection). Also, the CVE is rejected in the meantime that I submitted the AI PRP.
CVE-2024-9016

[tooryx]

Indeed, there was a bug. I have pushed a fix internally and it should be visible publicly within 24 hours.

[giacomo-doyensec]

Hi @VickyTheViking, thanks for your contribution.
I left a couple of comments down below. Feel free to reach out if you have any questions.

[giacomo-doyensec]

On my side, this causes the application to return {"error":"No columns to parse from file","success":false,...}, which makes the entire detection fail. I fixed it by adding some dummy data.

Suggested change

	headers: [
	{ name: "Content-Type" value: "multipart/form-data; boundary=----geckoformboundaryb38fffc548bd5dad82328985c3f223d4" }
	]
	data: '------geckoformboundaryb38fffc548bd5dad82328985c3f223d4\r\nContent-Disposition: form-data; name="simple-dtale-data.csv"; filename="simple-dtale-data.csv"\r\nContent-Type: text/csv\r\n\r\n------geckoformboundaryb38fffc548bd5dad82328985c3f223d4\r\nContent-Disposition: form-data; name="header"\r\n\r\ntrue\r\n------geckoformboundaryb38fffc548bd5dad82328985c3f223d4\r\nContent-Disposition: form-data; name="separatorType"\r\n\r\ncomma\r\n------geckoformboundaryb38fffc548bd5dad82328985c3f223d4\r\nContent-Disposition: form-data; name="separator"\r\n\r\n\r\n------geckoformboundaryb38fffc548bd5dad82328985c3f223d4--\r\n'
	headers: [
	{ name: "Content-Type" value: "multipart/form-data; boundary=-" }
	]
	data: '---\nContent-Disposition: form-data; name="data.csv"; filename="data.csv"\nContent-Type: text/csv\n\ntest,data\n\n---\nContent-Disposition: form-data; name="header"\n\ntrue\n---\nContent-Disposition: form-data; name="separatorType"\n\ncomma\n---\nContent-Disposition: form-data; name="separator"\n\n-----\n'

Please run the detector on your side and confirm if you can reproduce the issue and the fix.

[giacomo-doyensec]

I would suggest linking a cleanup action here so that no dirty data are left behind by the detector. It should be sufficient to issue a request like GET /dtale/cleanup-datasets?dataIds={{dataid}}

Suggested change

	}
	}
	cleanup_actions: "cleanup_data"