📄 Description (English)
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
🤖 AI Executive Summary
ERPNext 13.4.0 contains a critical sandbox escape vulnerability allowing authenticated System Manager users to execute arbitrary system commands through frame introspection in RestrictedPython. This vulnerability poses severe risk to Saudi organizations using ERPNext for ERP operations, as compromised or malicious administrators can gain full system control. Immediate action is required to restrict System Manager role assignments and implement compensating controls.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 8, 2026 16:32
🇸🇦 Saudi Arabia Impact Assessment
Critical impact on Saudi financial institutions (SAMA-regulated banks), government agencies (NCA oversight), and large enterprises using ERPNext for financial management and supply chain operations. ARAMCO subsidiaries, STC divisions, and healthcare organizations managing patient billing systems are at high risk. Compromised System Manager accounts could lead to unauthorized financial transactions, data exfiltration, system compromise, and regulatory violations under SAMA and NCA frameworks.
🏢 Affected Saudi Sectors
Banking and Financial Services
Government and Public Administration
Healthcare and Pharmaceuticals
Energy and Utilities
Telecommunications
Manufacturing and Industrial
Retail and E-commerce
Education
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
9.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Audit all System Manager role assignments and remove unnecessary users immediately
2. Enable comprehensive logging for server-script endpoint access and RestrictedPython execution
3. Implement network segmentation to restrict ERPNext server access to authorized networks only
4. Review audit logs for suspicious server-script creation or execution patterns
COMPENSATING CONTROLS (until patch available):
5. Disable server-script functionality entirely if not critical to operations via bench command: bench set-config server_script_enabled 0
6. Implement application-level access controls restricting /app/server-script endpoint to specific IP addresses
7. Deploy Web Application Firewall (WAF) rules to block server-script POST requests from unauthorized sources
8. Enforce multi-factor authentication for all System Manager accounts
9. Implement real-time monitoring for os.popen, subprocess, and exec function calls within ERPNext processes
DETECTION RULES:
- Monitor for DocType 'Server Script' creation/modification in audit logs
- Alert on any frame introspection attempts (gi_frame attribute access)
- Track execution of system commands from ERPNext application user context
- Monitor for unusual child process spawning from ERPNext bench processes
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تدقيق جميع تعيينات دور مدير النظام وإزالة المستخدمين غير الضروريين فوراً
2. تفعيل تسجيل شامل لوصول نقطة نهاية server-script وتنفيذ RestrictedPython
3. تنفيذ تقسيم الشبكة لتقييد وصول خادم ERPNext إلى الشبكات المصرح بها فقط
4. مراجعة سجلات التدقيق للبحث عن أنماط مريبة في إنشاء أو تنفيذ server-script
الضوابط التعويضية (حتى توفر التصحيح):
5. تعطيل وظيفة server-script بالكامل إذا لم تكن حرجة للعمليات عبر أمر bench: bench set-config server_script_enabled 0
6. تنفيذ ضوابط الوصول على مستوى التطبيق لتقييد نقطة نهاية /app/server-script على عناوين IP محددة
7. نشر قواعد جدار الحماية لتطبيقات الويب (WAF) لحظر طلبات server-script POST من مصادر غير مصرح بها
8. فرض المصادقة متعددة العوامل لجميع حسابات مدير النظام
9. تنفيذ المراقبة في الوقت الفعلي لوظائف os.popen و subprocess و exec داخل عمليات ERPNext
قواعد الكشف:
- مراقبة إنشاء/تعديل DocType 'Server Script' في سجلات التدقيق
- التنبيه على أي محاولات استكشاف إطار (وصول سمة gi_frame)
- تتبع تنفيذ أوامر النظام من سياق مستخدم تطبيق ERPNext
- مراقبة توليد عمليات فرعية غير عادية من عمليات bench في ERPNext
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.9.2.1 - User access management and role-based access control
ECC 2024 A.8.1.1 - Information security policies and procedures
ECC 2024 A.12.4.1 - Event logging and monitoring
ECC 2024 A.12.6.1 - Management of technical vulnerabilities
🔵 SAMA CSF
SAMA CSF ID.AM-2 - Software and hardware inventory
SAMA CSF PR.AC-1 - Access control policy and procedures
SAMA CSF DE.CM-1 - System monitoring and anomaly detection
SAMA CSF RS.MI-2 - Incident response and recovery procedures
🟡 ISO 27001:2022
ISO 27001:2022 A.5.15 - Access control
ISO 27001:2022 A.8.22 - Monitoring activities
ISO 27001:2022 A.8.23 - Administrator and operator logs
ISO 27001:2022 A.8.28 - Secure development policy
🟣 PCI DSS v4.0.1
PCI DSS 2.1 - Inventory of system components
PCI DSS 7.1 - Limit access to system components
PCI DSS 10.2 - Implement automated audit trails
PCI DSS 11.2 - Vulnerability scanning and assessment
🔗 References & Sources 8
🔗
http://erpnext.org
disclosure@vulncheck.com
Product
🔗
https://frappeframework.com/docs/v13/user/en/desk/scripting/server-script
disclosure@vulncheck.com
Product
🔗
https://gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6
disclosure@vulncheck.com
Exploit
🔗
https://github.com/frappe/frappe/
disclosure@vulncheck.com
Product
🔗
https://github.com/frappe/frappe/blob/v13.4.0/frappe/utils/safe_exec.py#L42
disclosure@vulncheck.com
Product
🔗
https://ur4ndom.dev/posts/2023-07-02-uiuctf-rattler-read/
disclosure@vulncheck.com
Not Applicable
🔗
https://www.exploit-db.com/exploits/51580
disclosure@vulncheck.com
Exploit
VDB Entry
🔗
https://www.vulncheck.com/advisories/frappe-framework-erpnext-remote-code-execution
disclosure@vulncheck.com
Third Party Advisory
📦 Affected Products / CPE 1 entries
frappe:erpnext:13.4.0