PT-2025-5646 · Asteval · Asteval
Published
2025-01-23
·
Updated
2025-01-23
CVSS v3.1
8.4
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
asteval (affected versions not specified)
Description:
The issue arises from how
asteval performs attribute access verification, specifically in the on attribute node handler. This handler prevents access to attributes that are either present in the UNSAFE ATTRS list or are formed by names starting and ending with . However, instances of the Procedure class expose their AST without proper protection, allowing an attacker to modify the AST during runtime and leverage unintended behavior. An attacker can exploit this by hooking any Attribute AST node, modifying the node.attr.startswith function to point to a custom procedure, and then using the obtained reference to retrieve malicious attributes without passing the on attribute checks.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Asteval