CVE-2023-54406: Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts
Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.insafeexec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Frappe versions before 14.59.0, or 15.x versions before 15.5.0, are affected if high-privileged authenticated users can create or modify Server Scripts.
What does an attacker need to exploit this issue?
An attacker needs authenticated high-privileged access and the ability to craft a Server Script. The script must trigger another Server Script, for example by saving a document, causing subsequent code to execute after the safe-execution flag becomes False.
Is this exploitable by an unauthenticated remote attacker?
No. The provided vector requires high privileges and authenticated access; no user interaction is required.
What version should be used to remediate the issue?
Upgrade Frappe to 14.59.0 or later on the 14.x branch, or to 15.5.0 or later on the 15.x branch.