CVE-2024-47532

RestrictedPython allows access to sensitive info via AttributeError.obj.

• CVSS 8.7
• CWE-200
• Information Leakage
• Remote

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.

CVE

CVE-2024-47532

CWE

CWE-200

CVSS base score

8.7

Published

2024-09-30

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

RestrictedPy

Fixed by upgrading

Yes

Solution

Upgrade to RestrictedPython version 7.3 or remove the string module from RestrictedPython.Utilities.utility_builtins.

from RestrictedPython import compile_restricted
from RestrictedPython.Utilities import utility_builtins

code = "result = string.ascii_letters"
compiled_code = compile_restricted(code, '<string>', 'exec')

namespace = {}
exec(compiled_code, namespace)

print(namespace['result'])

from RestrictedPython import compile_restricted
from RestrictedPython.Utilities import utility_builtins

restricted_globals = {
    '__builtins__': utility_builtins,
    'string': __import__('string')
}

blacklist = ['exec', 'eval', 'os', 'sys', 'subprocess']

def modified_exec(compiled_code, globals_dict, locals_dict):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    for forbidden in blacklist:
        if forbidden in compiled_code:
            raise ValueError(f"Execution of '{forbidden}' is not allowed.")
    exec(compiled_code, globals_dict, locals_dict)

code = "result = string.ascii_letters"
compiled_code = compile_restricted(code, '<string>', 'exec')

namespace = {}
modified_exec(compiled_code, restricted_globals, namespace)

print(namespace['result'])

result = AttributeError.__init__.__globals__['__builtins__']['open']('/etc/passwd').read()

@misc{vaitp:cve202447532,
  title        = {{RestrictedPython allows access to sensitive info via AttributeError.obj.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-47532},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-47532/}}
}