{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/senaite/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["senaite.core (2.0.0 - 2.6.0)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","injection","web-application","senaite"],"_cs_type":"advisory","_cs_vendors":["SENAITE"],"content_html":"\u003cp\u003eThe senaite.core library, used in laboratory information management systems (LIMS), is vulnerable to unauthenticated remote code execution due to a two-step flaw in its JSON API handling. An attacker can exploit this by first discovering the UID of a readable object using the standard Plone @@uuid view and subsequently submitting a crafted POST request to the /@@API/update route. The update route fails to perform required authorization checks, allowing anonymous users to interact with fields. The vulnerability is triggered when the API processes input fields of type RecordsField or RecordField; the application passes these raw request strings to a Python eval() function before verifying any write permissions. This allows the execution of arbitrary commands within the Zope worker process, granting the attacker full access to the ZODB database, filesystem, and network egress, effectively leading to total system compromise. This issue affects all versions of senaite.core from 2.0.0 through 2.6.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs a GET request to the /@@uuid endpoint on an anonymously readable object (e.g., /senaite/bika_setup/@@uuid) to retrieve its unique identifier.\u003c/li\u003e\n\u003cli\u003eAttacker sends a malicious POST request to the /@@API/update endpoint, targeting the previously retrieved UID via the obj_uid parameter.\u003c/li\u003e\n\u003cli\u003eThe request passes the /@@API/update route handler, which incorrectly permits unauthenticated users to invoke state-changing actions.\u003c/li\u003e\n\u003cli\u003eThe application logic executes the set_fields_from_request function, which iterates through provided JSON API request fields.\u003c/li\u003e\n\u003cli\u003eThe function identifies fields designated as RecordsField or RecordField and passes the attacker-supplied string directly to the Python eval() function.\u003c/li\u003e\n\u003cli\u003eThe eval() function interprets and executes the malicious Python payload (e.g., subprocess calls) within the context of the Zope worker process.\u003c/li\u003e\n\u003cli\u003eThe system processes the malicious code, establishing a reverse shell or exfiltrating data, even if the subsequent write to the database fails.\u003c/li\u003e\n\u003cli\u003eAttacker gains durable post-exploitation persistence by interacting with the Zope Management Interface (ZMI) or modifying administrative users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution in the context of the Zope worker process. This allows unauthorized attackers to read and modify sensitive laboratory data, compromise the ZODB database, access the underlying host filesystem, and use the compromised container for lateral movement or further network activity. As the vulnerability is unauthenticated and affects default configurations, any internet-facing instance of senaite.core 2.0.0-2.6.0 is at high risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately apply the vendor-recommended security patch to all senaite.core instances, ensuring that AccessJSONAPI permissions are enforced across all API routes and replacing eval() calls with json.loads().\u003c/li\u003e\n\u003cli\u003eBlock external access to the /@@API/update, /@@API/update_many, /@@API/remove, and /@@API/doActionFor endpoints at the web application firewall (WAF) or reverse proxy level until patching is completed.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to monitor for suspicious POST requests targeting JSON API update routes.\u003c/li\u003e\n\u003cli\u003eEnsure that the Zope Management Interface (ZMI) at /manage is restricted to trusted administrative IP addresses and not exposed to the public internet.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-26T20:20:35Z","date_published":"2026-08-26T20:20:35Z","id":"https://feed.craftedsignal.io/briefs/2026-08-senaite-eval-injection/","summary":"An unauthenticated remote code execution vulnerability in senaite.core allows attackers to execute arbitrary Python code via a two-request chain leveraging missing authorization and unsafe eval() usage in the JSON API.","title":"Unauthenticated Remote Code Execution in senaite.core","url":"https://feed.craftedsignal.io/briefs/2026-08-senaite-eval-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - SENAITE","version":"https://jsonfeed.org/version/1.1"}