Description
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Frappe ERPNext
Default version status: unaffected
16.0.0 to < 16.34.1affected
pkg:github/frappe/erpnextReferences
- https://github.com/frappe/erpnext/security/advisories/GHSA-794x-fhm7-58j7 ↗
- https://github.com/frappe/erpnext/commit/7aad59b129711e9bba17b25665428d1fc57bf37c ↗
- https://github.com/frappe/erpnext/blob/v16.34.0/erpnext/accounts/doctype/financial_report_template/financial_report_engine.py#L1166-L1171 ↗
- https://github.com/frappe/erpnext/blob/v16.34.0/erpnext/accounts/doctype/financial_report_template/financial_report_template.json ↗
- https://github.com/frappe/erpnext ↗
- https://www.vulncheck.com/advisories/frappe-erpnext-before-16.34.1-unauthorized-method-invocation ↗