Remote Code Execution Vulnerability in RPyC Package
Summary
DEBIAN-CVE-2024-27758: In RPyC before 6.0.0, when a server exposes a method that calls the attribute named array for a client-provided netref (e.g., np.array(client_netref)), a remote attacker can craft a class that results in remote code exec... Affects rpyc versions < 6.0.0-1. Fixed in 6.0.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RPyC (Remote Python Call) is a Python library that allows for remote procedure calls, enabling communication between Python programs over a network. It is designed to facilitate the execution of Python code on a remote server as if it were local. The library supports various features such as object serialization and remote method invocation, making it a popular choice for distributed applications. However, a critical vulnerability has been identified in versions prior to 6.0.0, which exposes users to potential remote code execution risks.
Vulnerability Detail
In RPyC versions before 6.0.0, a security flaw exists when a server exposes a method that calls the attribute named array for a client-provided netref. This vulnerability allows a remote attacker to craft a malicious class that can lead to remote code execution when the server processes the client-provided netref, potentially compromising the server's integrity and security.
How To Fix
Minimum fixed version
6.0.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rpycTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid exposing methods that utilize the array attribute for client-provided netrefs until the package can be updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The RPyC package has a critical vulnerability that allows for remote code execution in versions prior to 6.0.0. Users are strongly advised to update to the latest version to mitigate risks. In the meantime, implementing workarounds can help reduce exposure to potential attacks.
See every vulnerability recorded for rpyc →
FAQ
RPyC is a Python library that enables remote procedure calls, allowing Python programs to communicate and execute code on remote servers.
The vulnerability allows remote attackers to execute arbitrary code on the server by exploiting methods that handle client-provided netrefs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, the vulnerability has been patched in version 6.0.0-1 of the RPyC package. Updating to this version will resolve the issue.
If immediate updates are not possible, consider implementing workarounds such as avoiding the exposure of methods that utilize the array attribute for client-provided netrefs.
References
Related vulnerabilities
Recent vulnerabilities recorded for rpyc.
