CVE-2023-54345
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
Schwachstellenklasse
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
Betroffene Produkte
- frappe erpnext
Quellen
- http://erpnext.org
- https://frappeframework.com/docs/v13/user/en/desk/scripting/server-script
- https://gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6
- https://github.com/frappe/frappe/
- https://github.com/frappe/frappe/blob/v13.4.0/frappe/utils/safe_exec.py#L42
- https://ur4ndom.dev/posts/2023-07-02-uiuctf-rattler-read/
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.