Scan report

ProbiusOfficial / Hello-CTF

View on GitHub (opens in a new tab)
HTML
4218 stars
Scanned 24 Sep 2026, 09:45

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

29 risk score

Real issues worth reviewing before you rely on this code.

High: 2
Medium: 14
Low: 11

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 2

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

29 total findings

Likely real: 6
Uncertain: 8
Likely noise: 15

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository has a medium vulnerability score of 29, which indicates that while the code does not appear to be maliciously crafted, it contains several common insecure coding patterns that an attacker could exploit. These issues include running the application with a writable root filesystem and allowing it to bind to all network interfaces, which means anyone on the internet could potentially access or modify files inside the container. Additionally, there are concerns about using weak hash algorithms and dynamic file paths, but these are standard weaknesses found in many applications rather than signs of hidden malicious intent. The scan also flagged a GitHub Actions workflow that uses mutable tags, which is a supply chain risk but does not necessarily mean the code itself is dangerous. Overall, the findings suggest the project needs careful review to fix these specific security gaps before it can be considered safe for production use.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Bandit 16

Python security linter · Vulnerability
Semgrep 11

Pattern-based code analysis · Vulnerability
YARA 2

Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/collector/Dockerfile line 12

Likely real
Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
```
CMD ["python3", "app.py"]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/Dockerfile line 19

Likely real
Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
```
CMD ["mkdocs", "serve", "-a", "0.0.0.0:8000"]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/docker-compose.yml line 3

Likely real
Yes, 100% confidence

Service 'hello-ctf' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.
```
hello-ctf:
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/admin/app.py line 382

Likely real
Yes, 99% confidence

Running flask app with host 0.0.0.0 could expose the server publicly.
```
app.run(host="0.0.0.0", port=port)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/docker-compose.yml line 3

Likely real
Yes, 99% confidence

Service 'hello-ctf' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.
```
hello-ctf:
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/collector/app.py line 65

Likely real
Yes, 52% confidence

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.
```
with urllib.request.urlopen(req, timeout=10) as resp:
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ghdeploy.yml line 23

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ghdeploy.yml line 26

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-python@v5
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/events_update.py line 263

Likely real
Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False
```
262         "DTEND": finish.strftime("%Y%m%dT%H%M%SZ"),
263         "UID": hashlib.md5(event["比赛名称"].encode("utf-8")).hexdigest(),
264         "DTSTAMP": datetime.now().strftime("%Y%m%dT%H%M%SZ"),
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/events_update.py line 244

Likely real
Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False
```
243         "DTEND": finish.strftime("%Y%m%dT%H%M%SZ"),
244         "UID": hashlib.md5(event["name"].encode("utf-8")).hexdigest(),
245         "DTSTAMP": datetime.now().strftime("%Y%m%dT%H%M%SZ"),
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/collector/app.py line 65

Likely real
Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
```
64             )
65             with urllib.request.urlopen(req, timeout=10) as resp:
66                 result = json.loads(resp.read().decode("utf-8"))
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/collector/app.py line 184

Likely real
Uncertain, 37% confidence

Possible binding to all interfaces.
```
183     print(f"Hello-CTF 消息收集器已启动：0.0.0.0:{PORT}，存储 {STORE}")
184     ThreadingHTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/admin/app.py line 382

Likely real
Uncertain, 37% confidence

Possible binding to all interfaces.
```
381     print(f"Hello-CTF 管理面板已启动：http://0.0.0.0:{port}")
382     app.run(host="0.0.0.0", port=port)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/overrides/partials/content.html line 84

Likely real
Uncertain, 36% confidence

This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
```
<script src="https://cdn.jsdelivr.net/npm/pangu.simple@1.0.5/dist/browser/pangu.js"></script>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/overrides/main.html line 152

Likely real
Uncertain, 36% confidence

This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
```
<script src="https://cdn.jsdelivr.net/npm/mermaid@10/dist/mermaid.min.js"></script>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/admin/static/index.html line 536

Likely real
Uncertain, 36% confidence

This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
```
<script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/admin/deployer.py line 7

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
6 import shutil
7 import subprocess
8 import threading
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/admin/repo_sync.py line 7

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
6 import os
7 import subprocess
8
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/admin/ctftime.py line 9

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
8 import os
9 import subprocess
10 import sys
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/admin/repo_sync.py line 26

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
25     try:
26         proc = subprocess.run(
27             ["git", "-C", REPO_ROOT, *args],
28             capture_output=True, text=True, timeout=GIT_TIMEOUT, env=env,
29         )
30     except subprocess.TimeoutExpired:
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /admin/deployer.py line 126
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

125         # 没有变更时 commit 会失败，这里先检查
126         status = subprocess.run(
127             ["git", "status", "--porcelain"],
128             cwd=self.repo_root, capture_output=True, text=True, timeout=60,
129             env=self._proc_env(),
130         )
131         if not status.stdout.strip():

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/admin/ctftime.py line 105

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
104             env[k] = proxy
105     proc = subprocess.run(
106         ["git", "-C", REPO_ROOT, *args],
107         capture_output=True, text=True, timeout=GIT_TIMEOUT, env=env,
108     )
109     if proc.returncode != 0:
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /admin/deployer.py line 186
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

185             try:
186                 self._preview_proc = subprocess.Popen(
187                     [self.mkdocs, "serve", "-a", "0.0.0.0:8000"],
188                     cwd=self.repo_root,
189                     stdout=subprocess.PIPE,
190                     stderr=subprocess.STDOUT,
191                     text=True,
192                 )
193             except Exception as e:

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/admin/repo_sync.py line 26

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
25     try:
26         proc = subprocess.run(
27             ["git", "-C", REPO_ROOT, *args],
28             capture_output=True, text=True, timeout=GIT_TIMEOUT, env=env,
29         )
30     except subprocess.TimeoutExpired:
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /admin/deployer.py line 126
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

125         # 没有变更时 commit 会失败，这里先检查
126         status = subprocess.run(
127             ["git", "status", "--porcelain"],
128             cwd=self.repo_root, capture_output=True, text=True, timeout=60,
129             env=self._proc_env(),
130         )
131         if not status.stdout.strip():

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /admin/deployer.py line 71
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

70         try:
71             proc = subprocess.Popen(
72                 cmd,
73                 cwd=self.repo_root,
74                 stdout=subprocess.PIPE,
75                 stderr=subprocess.STDOUT,
76                 text=True,
77                 env=self._proc_env(),
78             )
79         except FileNotFoundError:

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/admin/ctftime.py line 105

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
104             env[k] = proxy
105     proc = subprocess.run(
106         ["git", "-C", REPO_ROOT, *args],
107         capture_output=True, text=True, timeout=GIT_TIMEOUT, env=env,
108     )
109     if proc.returncode != 0:
```