ReversingLabs discovered legacy bootstrap scripts in popular Python packages that fetch and execute an installation script from the abandoned python-distribute[.]org domain, creating a potential domain-takeover supply-chain risk for developers who run those scripts. The issue affects packages such as slapos.core, pypiserver and tornado and echoes a prior npm compromise (fsevents), highlighting the danger of hardcoded domains in build automation. #python-distribute #PyPI
Keypoints
- ReversingLabs’ RL Spectra Assure Community model flagged vulnerable bootstrap scripts that fetch and execute an installer from python-distribute[.]org.
- Bootstrap scripts used by zc.buildout can fetch the legacy distribute installation script (from python-distribute[.]org), enabling arbitrary code execution if the domain is controlled by an attacker.
- Multiple popular PyPI projects (slapos.core, pypiserver, tornado, imio.pm.locales, pyquery, xlutils, roman, testfixtures and others) were identified as shipping or having shipped vulnerable bootstrap files or Makefiles that invoke them.
- The python-distribute[.]org domain was dropped and later parked in 2014, making it available for purchase and abuse via domain takeover, though no documented misuse of this specific domain has been found.
- The dangerous behavior requires manual execution (developer runs bootstrap.py) or invocation via a Makefile, but still represents an unnecessary attack surface in modern packages.
- ReversingLabs demonstrated a Python 2 proof-of-concept exploiting slapos.core’s bootstrap script and linked the risk to a real-world precedent (the 2023 fsevents npm compromise).
MITRE Techniques
- [T1195 ] Supply Chain Compromise – Attackers can compromise software distribution by taking over the hard-coded domain used to fetch installers, enabling malicious code delivery (‘…a supply chain compromise via a domain takeover attack…’).
- [T1105 ] Ingress Tool Transfer – The bootstrap script fetches and executes an installation script from an external domain, effectively transferring a tool/payload into the environment (‘…it fetches and executes an installation script for the package distribute from python-distribute[.]org’).
- [T1059 ] Command and Scripting Interpreter – The vulnerability relies on executing Python bootstrap scripts that in turn execute downloaded installation scripts (‘…the bootstrap script … fetches and executes its installation script’).
- [T1204 ] User Execution – The malicious behavior manifests only if an unsuspecting developer manually runs the bootstrap script or if it is invoked via a Makefile (‘…could manifest itself only with manual execution of the script by an unsuspecting developer or via the Makefile’).
- [T1583 ] Acquire Infrastructure (Domains) – The attack vector depends on an attacker acquiring or controlling an abandoned domain (python-distribute[.]org) to serve malicious code (‘…the domain was dropped … parked to drive ad revenue since December of 2014. This could easily be exploited by an attacker’).
Indicators of Compromise
- [Domain ] legacy installer host used to deliver code – python-distribute[.]org
- [Cloud storage URL ] example of a prior exploited resource used to deliver malicious binaries – https[:]//fsevents-binaries[.]s3-us-west-2[.]amazonaws[.]com
- [PyPI package names ] packages identified as shipping bootstrap scripts or Makefiles invoking them – slapos.core, pypiserver, tornado, and at least a dozen other PyPI packages
- [File names ] build automation files that trigger the behavior – bootstrap.py, Makefile
- [File hashes ] hashes of bootstrap scripts collected by ReversingLabs – e.g., sha1: 357f2fe2684c54339fb78ff447d8cbc12707163…, and additional hashes reported by the investigation
Read more: https://www.reversinglabs.com/blog/bootstrap-script-exposes-pypi-to-domain-takeover-attack