CircuitVerse potential RCE vulnerability via Oj.load

Vulnerability

CircuitVerse, an open-source digital logic circuit simulation platform, contains a remote code execution vulnerability due to insecure deserialization. The issue resides in the sanitize_data method, which uses Oj.load (instead of the safer Oj.safe_load) to process JSON data submitted by users. The vulnerable code path is reachable when a user with an active session sends a specially crafted JSON payload. This affects all versions prior to commit 7b3023a99499a7675f10f2c1d9effdf10c35fb6e [1].

Exploitation

An authenticated attacker can exploit this vulnerability by sending a malicious JSON payload to the server. The attacker does not require any special privileges beyond a valid account. The insecure Oj.load call will deserialize the payload, which can contain arbitrary objects, leading to code execution. No user interaction beyond the authenticated request is needed [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the CircuitVerse server. This results in a full compromise of confidentiality, integrity, and availability of the application and its data. The attacker gains the ability to read, modify, or delete any project data, user information, and potentially pivot to the underlying server infrastructure [1].

Mitigation

The vulnerability has been patched in commit 7b3023a99499a7675f10f2c1d9effdf10c35fb6e by replacing Oj.load with Oj.safe_load [2]. As of the publication date (2022-09-06), no workarounds are available; users must apply the patch by updating to the latest version of CircuitVerse [1].