Remote Code Execution Vulnerability in RPyC Package
Summary
CVE-2024-27758: In RPyC before 6.0.0, when a server exposes a method that calls the attribute named array for a client-provided netref (e.g., np.array(client_netref)), a remote attacker can craft a class that results in remote code exec... Affects rpyc versions < 0194cbdf6992ab5eaaea973c596c1efa4e33193f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RPyC (Remote Python Call) is a Python library that allows for remote procedure calls, enabling Python objects to be accessed and manipulated over a network. It is widely used for building distributed applications. However, prior to version 6.0.0, RPyC had a critical vulnerability that allowed remote attackers to execute arbitrary code by exploiting the way the library handled client-provided netrefs, particularly when invoking the array attribute.
Vulnerability Detail
In RPyC versions prior to 6.0.0, a vulnerability exists that allows a remote attacker to craft a malicious class that, when processed by the server, can lead to remote code execution. This occurs when the server exposes a method that calls the array attribute on a client-provided netref, such as np.array(client_netref). The implications of this vulnerability are severe, as it can allow attackers to execute arbitrary code on the server, potentially leading to data breaches or complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing strict input validation and sanitization for any client-provided netrefs. Additionally, avoid exposing methods that directly call the array attribute on client inputs until the package can be updated.
Conclusion
The RPyC package has a critical vulnerability (CVE-2024-27758) that allows for remote code execution through improper handling of client-provided netrefs. It is essential to upgrade to version 6.0.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for rpyc →
FAQ
RPyC is a Python library that facilitates remote procedure calls, allowing users to interact with Python objects over a network.
CVE-2024-27758 is a vulnerability in RPyC that allows remote code execution through the exploitation of the array attribute on client-provided netrefs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to the server, potential data breaches, and the ability for attackers to execute arbitrary code, which could compromise the entire system.
Regularly update your dependencies, monitor for vulnerabilities using tools like Vulert, and implement security best practices such as input validation.
Related vulnerabilities
Recent vulnerabilities recorded for rpyc.
