CVE-2024-48050: Modelscope Agentscope RCE Vulnerability

CVE-2024-48050 Overview

CVE-2024-48050 is a critical Remote Code Execution (RCE) vulnerability discovered in ModelScope's AgentScope framework. The vulnerability exists within the is_callable_expression function in the file agentscope/web/workstation/workflow_utils.py. The function uses Python's dangerous eval() function to directly execute user-provided input without proper sanitization, allowing unauthenticated attackers to execute arbitrary commands on vulnerable systems.

Critical Impact

This vulnerability allows unauthenticated remote attackers to achieve complete system compromise through arbitrary code execution via crafted input to the workflow utilities component.

Affected Products

• ModelScope AgentScope version 0.0.4 and earlier
• All deployments utilizing the AgentScope web workstation component
• Systems exposing the workflow_utils.py functionality to network access

Discovery Timeline

• 2024-11-04 - CVE-2024-48050 published to NVD
• 2025-09-04 - Last updated in NVD database

Technical Details for CVE-2024-48050

Vulnerability Analysis

This vulnerability represents a classic Code Injection flaw (CWE-94) stemming from the unsafe use of Python's eval() function. The is_callable_expression function in workflow_utils.py is designed to validate whether a given string represents a callable expression. However, instead of implementing proper parsing or validation logic, the function directly passes user-controlled input to eval(s), where s is the untrusted string.

The use of eval() with unsanitized user input is one of the most dangerous practices in Python development. This function interprets and executes the given string as Python code with the same privileges as the running application. Since AgentScope operates as a web-accessible workstation component, this vulnerability can be exploited remotely without authentication.

Root Cause

The root cause of this vulnerability is the direct use of Python's eval() function on user-controlled input within the is_callable_expression function. The function was likely intended to check if a given expression is callable, but the implementation failed to consider the security implications of executing arbitrary code. Proper input validation, whitelisting of allowed expressions, or the use of safer alternatives like ast.literal_eval() for limited evaluation were not implemented.

Attack Vector

The attack vector for CVE-2024-48050 is network-based and requires no authentication or user interaction. An attacker can craft malicious input containing Python code that, when passed to the vulnerable is_callable_expression function, gets executed directly by the eval() call. This could include commands to:

• Execute system commands via os.system() or subprocess modules
• Read or write arbitrary files on the system
• Establish reverse shell connections for persistent access
• Exfiltrate sensitive data or credentials
• Deploy malware or cryptominers

The exploitation is straightforward since the attacker simply needs to construct a payload string that imports dangerous modules and executes arbitrary commands. A detailed analysis of this RCE vulnerability is available in the Notion Analysis on RCE, and a proof-of-concept can be found at the GitHub Gist PoC.

Detection Methods for CVE-2024-48050

Indicators of Compromise

• Unexpected process spawning from the AgentScope application, particularly shell processes or Python interpreters
• Suspicious network connections originating from AgentScope server processes
• Unusual file system activity in or around the AgentScope installation directory
• Log entries showing unusual or malformed input strings to workflow endpoints

Detection Strategies

• Monitor for anomalous HTTP requests to AgentScope workflow endpoints containing Python code patterns such as __import__, eval, exec, os.system, or subprocess
• Implement application-level logging to capture all input to the is_callable_expression function
• Deploy network intrusion detection rules to identify exploitation attempts targeting the workflow_utils component
• Use process monitoring to detect child processes spawned from the AgentScope application server

Monitoring Recommendations

• Enable verbose logging on AgentScope deployments and forward logs to a SIEM for correlation
• Set up alerts for any process execution chains starting from the AgentScope web server process
• Monitor outbound network connections from AgentScope servers for potential reverse shell or data exfiltration activity

How to Mitigate CVE-2024-48050

Immediate Actions Required

• Upgrade AgentScope to a version newer than v0.0.4 that addresses this vulnerability
• If unable to upgrade immediately, restrict network access to the AgentScope web workstation component
• Implement Web Application Firewall (WAF) rules to block requests containing common Python code injection patterns
• Review logs for signs of prior exploitation attempts

Patch Information

Organizations using ModelScope AgentScope should upgrade to versions newer than v0.0.4 where this vulnerability has been addressed. Users should monitor the official ModelScope repository for security updates and patch announcements. Review the GitHub Gist PoC to understand the exploitation mechanism and verify your deployment is protected.

Workarounds

• Restrict network access to the AgentScope web workstation to trusted IP addresses only using firewall rules
• Deploy the application behind a reverse proxy with strict input validation to filter malicious payloads
• Disable or remove the web workstation component if it is not required for your deployment
• Implement application-level authentication before the workflow_utils endpoints if not already present

# Example: Restrict access to AgentScope workstation using iptables
# Allow only trusted IP ranges to access AgentScope (adjust ports as needed)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP