ID:13141 - Exploit for Improperly implemented security check for standard in RPyC - CVE-2019-16328

Link to public exploit:

Vulnerability description

The vulnerability allows an authenticated, low-privileged remote attacker to execute arbitrary Python code by modifying exposed methods of a custom RPyC service.

The vulnerability exists due to a missing access check in RPyC's comparison request handler when processing crafted requests that access otherwise restricted object attributes. An authenticated, low-privileged remote attacker can replace an exposed service method with an evaluation function, leaving the modified behavior accessible through subsequent connections.

Remediation