CVE-2016-3952
📋 TL;DR
This vulnerability in web2py allows remote attackers to read environment variables via direct access to the beautify example file. When combined with CVE-2016-3957, this information disclosure can be leveraged to gain administrative access and potentially execute arbitrary code. Affects web2py standalone installations before version 2.14.1.
💻 Affected Systems
- web2py
📦 What is this software?
Web2py by Web2py
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers gain administrative access to the web2py application, leading to complete system compromise and arbitrary code execution.
Likely Case
Attackers obtain sensitive environment variables (potentially containing secrets, database credentials, or configuration data) which can be used for further attacks.
If Mitigated
Limited information disclosure with no path to privilege escalation if proper access controls are implemented.
🎯 Exploit Status
Simple HTTP GET request to /examples/template_examples/beautify. Often combined with CVE-2016-3957 for full exploit chain.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.14.1
Vendor Advisory: https://github.com/web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40
Restart Required: Yes
Instructions:
1. Upgrade web2py to version 2.14.1 or later. 2. Download from https://web2py.com. 3. Replace existing installation. 4. Restart web2py service.
🔧 Temporary Workarounds
Remove examples directory
allDelete or restrict access to the examples directory to prevent exploitation.
rm -rf /path/to/web2py/examples
chmod 000 /path/to/web2py/examples
Web server access control
allConfigure web server to block access to /examples/* paths.
# Apache: <Location "/examples"> Require all denied </Location>
# Nginx: location /examples { deny all; }
🧯 If You Can't Patch
- Remove or restrict access to the examples directory using file permissions or web server configuration
- Implement network segmentation to limit access to web2py instances from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[web2py-host]/examples/template_examples/beautify. If it returns environment variable data, the system is vulnerable.Check Version:
cat /path/to/web2py/VERSION or check web2py admin interfaceVerify Fix Applied:
After patching, the same URL should return 404 or access denied. Check web2py version is 2.14.1 or higher.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /examples/template_examples/beautify
- Unusual access to example files
Network Indicators:
- HTTP requests to beautify endpoint from unexpected sources
SIEM Query:
source="web2py" AND (url="/examples/template_examples/beautify" OR url="/examples/*")🔗 References
- https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/
- https://github.com/web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40
- https://usn.ubuntu.com/4030-1/
- https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/
- https://github.com/web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40
- https://usn.ubuntu.com/4030-1/
