CVE-2024-27758

What it actually does

Deserialization flaw allows remote code execution when a server method invokes __array__ on a client-supplied netref, enabling arbitrary code via a crafted class.

Why it matters to the business

Attackers can gain full control of systems running vulnerable RPyC servers, risking data theft, service disruption, and lateral movement; moderate urgency due to absence from KEV and stable low EPSS.

How an attack unfolds

An attacker connects to an RPyC server exposing a method that accesses __array__ on netrefs, supplies a malicious class instance, and triggers code execution during attribute handling.

How to fix it

Upgrade tomerfiliba-org/rpyc to the commit 0194cbdf6992ab5eaaea973c596c1efa4e33193f or later (equivalent to version 6.0.0).

How to confirm the fix worked

Verify rpyc package version or commit hash matches the fixed revision; test exposed methods with benign netrefs to confirm no unexpected attribute access occurs.

Typical attack path

1. Establish connection to exposed RPyC server
2. Send crafted netref object referencing malicious class
3. Invoke server method that calls __array__ on the netref
4. Execute arbitrary code on the server

How to detect it

Review RPyC server logs for unexpected client netref objects or repeated __array__ attribute accesses; correlate with process execution anomalies post-connection.

What your security team should do

• Immediately update rpyc to the fixed commit across all deployments
• Audit and restrict methods exposed by RPyC servers
• Monitor for unusual client connections and netref handling
• Consider network segmentation for RPyC services