{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/qwed-5.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["qwed (5.1.1)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","input-validation","python"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe qwed package, specifically version 5.1.1, contains an authenticated remote code execution (RCE) vulnerability stemming from the unsafe use of \u003ccode\u003esympy.parsing.sympy_parser.parse_expr()\u003c/code\u003e. The application exposes two primary endpoints, \u003ccode\u003ePOST /verify/math\u003c/code\u003e and \u003ccode\u003ePOST /verify/batch\u003c/code\u003e, which accept user-supplied mathematical expressions. These inputs are passed directly to \u003ccode\u003eparse_expr()\u003c/code\u003e without configuring a restricted namespace for the underlying \u003ccode\u003eeval()\u003c/code\u003e call. Any user, including those creating new accounts via the default-enabled \u003ccode\u003e/auth/signup\u003c/code\u003e endpoint, can supply arbitrary Python code within these expressions. This allows for full server-side command execution under the context of the running application process. The lack of sandbox parameters (\u003ccode\u003eglobal_dict\u003c/code\u003e and \u003ccode\u003elocal_dict\u003c/code\u003e) in the SymPy calls effectively disables Python's built-in security boundaries, enabling attackers to read files, modify the local database, or execute OS-level commands.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker interacts with the \u003ccode\u003ePOST /auth/signup\u003c/code\u003e endpoint to create a standard, unprivileged tenant account.\u003c/li\u003e\n\u003cli\u003eAttacker uses the returned JWT to authenticate requests to the \u003ccode\u003ePOST /auth/api-keys\u003c/code\u003e endpoint to generate a persistent API key.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the \u003ccode\u003ePOST /verify/math\u003c/code\u003e or \u003ccode\u003ePOST /verify/batch\u003c/code\u003e endpoints as injection sinks for user-supplied math queries.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious Python expression payload using \u003ccode\u003epathlib\u003c/code\u003e or \u003ccode\u003eos\u003c/code\u003e modules to interact with the host filesystem.\u003c/li\u003e\n\u003cli\u003eAttacker submits the payload within the JSON \u003ccode\u003eexpression\u003c/code\u003e field (for \u003ccode\u003e/verify/math\u003c/code\u003e) or \u003ccode\u003equery\u003c/code\u003e field (for \u003ccode\u003e/verify/batch\u003c/code\u003e) using the previously generated API key.\u003c/li\u003e\n\u003cli\u003eThe server application receives the request and passes the unvalidated input string directly to the vulnerable \u003ccode\u003eparse_expr()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe SymPy library evaluates the injected Python code string via \u003ccode\u003eeval()\u003c/code\u003e within the process memory space.\u003c/li\u003e\n\u003cli\u003eFinal objective reached: arbitrary command execution, leading to complete server compromise or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution, granting the attacker the same permissions as the system user running the qwed API server. This permits unauthorized read/write access to the host filesystem, exfiltration of environment variables containing sensitive secrets (e.g., \u003ccode\u003eQWED_JWT_SECRET_KEY\u003c/code\u003e), modification of persistent data, and potential lateral movement within the container or host environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching the qwed package to a version that sanitizes all input passed to SymPy's \u003ccode\u003eparse_expr()\u003c/code\u003e function. If upgrading is not immediately possible, implement strict input validation to ensure math expressions only contain alphanumeric characters and expected mathematical operators, preventing the injection of Python syntax. Additionally, utilize the provided Sigma detection rule to monitor for suspicious POST requests to verification endpoints containing Python built-ins or module import syntax.\u003c/p\u003e\n","date_modified":"2026-08-25T18:50:28Z","date_published":"2026-08-25T18:50:28Z","id":"https://feed.craftedsignal.io/briefs/2026-08-qwed-rce/","summary":"The qwed package (version 5.1.1) fails to sanitize input in math verification endpoints, allowing authenticated attackers to achieve remote code execution via unsafe SymPy expression evaluation.","title":"Authenticated Remote Code Execution in qwed via Unsafe SymPy Parsing","url":"https://feed.craftedsignal.io/briefs/2026-08-qwed-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Qwed (5.1.1)","version":"https://jsonfeed.org/version/1.1"}