PySyft Remote Code Execution Vulnerability

A remote code execution vulnerability exists in PySyft (Syft Datasite/Server) versions 0.9.5 and earlier. This issue arises from inadequate validation and sandboxing of user-submitted code, allowing low-privileged users to send Python functions for remote execution on the server. Although there is a code approval process, submitted code is not subjected to security checks for potentially harmful operations, such as file access or command execution. Once approved, the code is executed within the server process using 'exec()' and 'eval()' without proper isolation. This vulnerability enables remote attackers to execute arbitrary Python code on the server, potentially leading to a complete compromise of the server environment.

Impact

Exploitation of this vulnerability allows for arbitrary Python code execution on the server, with the potential for complete compromise of the server environment.