Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| AccessControl | pip | < 7.4 | 7.4 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the guarded_getattr function within Zope's AccessControl component, with implementations in both Python and C. The core issue is that this function, which is meant to enforce security policies on attribute access, failed to properly restrict access to Python's powerful string formatting methods, format and format_map, specifically when used on subclasses of the built-in str type. The advisory states that while mitigations were in place for str itself, they did not cover subclasses. An attacker could create a subclass of str and then use a malicious format string to recursively access attributes and items of objects, bypassing the intended security controls (_getattr_ and _getitem_). This would lead to information disclosure. The patch rectifies this by explicitly checking for format and format_map within guarded_getattr and, if the object is a string or a string subclass, either applying a safe formatter or raising an Unauthorized exception. Therefore, the guarded_getattr function is the central vulnerable function as it was the point of failure in the access control mechanism.
guarded_getattrsrc/AccessControl/ImplPython.py
guarded_getattrsrc/AccessControl/cAccessControl.c