GHSA-74vm-8frp-7w68 — EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

The advisory, in context

Impact

EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.

Patches

EPyT-Flow has been patched in 0.16.1 -- affects all versions <= 0.16.0

Workarounds

Do not load any JSON from untrusted sources and do not expose the REST API.

Credits

EPyT-Flow thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

epyt-flow PyPI

Ecosystem versions

Earlier releases before 0.16.1

Fixed in 0.16.1

25 explicitly affected versions

0.1.0, 0.1.1, 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.13.1, 0.14.0, 0.14.1, 0.14.2, 0.15.0, 0.15.0b1, 0.16.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0, 0.6.0, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.8.0, 0.8.1, 0.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "0.16.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.1.0",
    "0.1.1",
    "0.10.0",
    "0.11.0",
    "0.12.0",
    "0.13.0",
    "0.13.1",
    "0.14.0",
    "0.14.1",
    "0.14.2",
    "0.15.0",
    "0.15.0b1",
    "0.16.0",
    "0.2.0",
    "0.3.0",
    "0.4.0",
    "0.5.0",
    "0.6.0",
    "0.7.0",
    "0.7.1",
    "0.7.2",
    "0.7.3",
    "0.8.0",
    "0.8.1",
    "0.9.0"
  ]
}

Set up in your agent.

Investigate in your agent.

EPyT-Flow vulnerable to unsafe JSON deserialization (type)