Description
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Frappe Technologies Frappe Framework (ERPNext)
13.4.0affected
References
- https://www.exploit-db.com/exploits/51580 ↗
- http://erpnext.org ↗
- https://github.com/frappe/frappe/ ↗
- https://ur4ndom.dev/posts/2023-07-02-uiuctf-rattler-read/ ↗
- https://gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6 ↗
- https://frappeframework.com/docs/v13/user/en/desk/scripting/server-script ↗
- https://github.com/frappe/frappe/blob/v13.4.0/frappe/utils/safe_exec.py#L42 ↗
- https://www.vulncheck.com/advisories/frappe-framework-erpnext-remote-code-execution ↗