CVE-2024-47532

What it actually does

The flaw permits indirect access to protected objects and sensitive data by leveraging the .obj attribute on AttributeError exceptions combined with functions from the string module within the restricted execution environment.

Why it matters to the business

Applications relying on RestrictedPython to sandbox untrusted code face risk of unauthorized information disclosure, which can expose internal state or secrets and undermine the security model of code-execution features.

How an attack unfolds

An attacker supplies crafted Python code to the restricted environment that deliberately triggers an AttributeError; the resulting exception object exposes its .obj attribute, and string module utilities are then used to inspect or extract otherwise protected attributes and data.

How to fix it

Upgrade zopefoundation/restrictedpython to the commit dc6c38f4da03c25683d90ab239a16dbae9d47b70. If the string module is not required, remove it from RestrictedPython.Utilities.utility_builtins as a temporary workaround.

How to confirm the fix worked

Confirm the patched commit is present in the deployed package; execute test code that attempts to reach protected objects via AttributeError.obj and verify access is denied.

Typical attack path

1. Submit malicious code to the RestrictedPython sandbox
2. Trigger an AttributeError on a protected object
3. Access the exposed .obj attribute on the exception
4. Use string module helpers to traverse and read internal data
5. Exfiltrate the disclosed information

How to detect it

Inspect application logs and audit trails for restricted-code execution that references AttributeError combined with string module access or repeated attribute introspection patterns.

What your security team should do

• Apply the fixed commit dc6c38f4da03c25683d90ab239a16dbae9d47b70 without delay
• Audit all uses of utility_builtins and restrict string module exposure where possible
• Review dependent projects for similar sandboxing patterns