Arelle Unauthenticated Remote Code Execution Vulnerability in REST Configure Endpoint

A remote code execution vulnerability has been identified in Arelle versions prior to 2.39.10. The issue resides in the /rest/configure REST endpoint, which accepts a plugins query parameter and forwards it to the plugin manager without any authentication or authorization. This vulnerability allows attackers to provide a URL pointing to a malicious Python file via the plugins parameter. Consequently, the Arelle web server downloads and executes the attacker-controlled code within the Arelle process, using its privileges.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server where Arelle is running.

Remediation

Users can upgrade to Arelle version 2.39.10 or later to address this vulnerability.