CVE-2023-54345
Frappe Framework ERPNext 13.4.0 Remote Code Execution
Résumé
Frappe Framework ERPNext 13.4.0 Remote Code Execution
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
Références
- advisory frappeframework.com
- advisory github.com
- advisory nvd.nist.gov
- advisory ur4ndom.dev
- advisory vulncheck.com
- report exploit-db.com
- web erpnext.org
- web gist.github.com
- web github.com
- web github.com