CVE-2025-24359: ASTEVAL Python RCE Vulnerability

CVE-2025-24359 Overview

CVE-2025-24359 is a Code Injection vulnerability in ASTEVAL, a Python library designed for safe evaluation of Python expressions and statements. Prior to version 1.0.6, an attacker who can control input to the asteval library can bypass its security restrictions and execute arbitrary Python code within the context of the application using the library.

The vulnerability stems from improper handling of FormattedValue AST nodes, where the on_formattedvalue method uses the dangerous str.format() method. This allows attackers to manipulate the string value used in the format call, enabling access to protected attributes by intentionally triggering AttributeError exceptions. By catching these exceptions and accessing their obj attribute, attackers can gain arbitrary access to sensitive or protected object properties.

Critical Impact

Attackers can bypass ASTEVAL's sandboxing restrictions to execute arbitrary Python code, potentially leading to complete application compromise, data theft, or lateral movement within the environment.

Affected Products

• ASTEVAL versions prior to 1.0.6
• Applications using vulnerable ASTEVAL versions for Python expression evaluation
• Systems accepting user-controlled input processed by ASTEVAL

Discovery Timeline

• 2025-01-24 - CVE CVE-2025-24359 published to NVD
• 2025-01-24 - Last updated in NVD database

Technical Details for CVE-2025-24359

Vulnerability Analysis

This vulnerability represents a sandbox escape in ASTEVAL's expression evaluation framework. ASTEVAL is commonly used when applications need to safely evaluate user-provided Python expressions without exposing the full Python interpreter. The security model relies on AST (Abstract Syntax Tree) parsing and controlled node handling to prevent dangerous operations.

The flaw exists in the on_formattedvalue method within asteval.py, specifically around line 507 in the source code. When processing f-string formatted values, the code invokes Python's native str.format() method with attacker-controllable input. This is a well-documented dangerous pattern in Python, as str.format() can access object attributes through its format specification mini-language.

The exploitation technique leverages Python's exception handling mechanism. When an AttributeError is raised, the exception object contains an obj attribute referencing the object where the attribute lookup failed. Attackers can weaponize this behavior to traverse object graphs and access protected attributes that ASTEVAL's sandbox was designed to prevent.

Root Cause

The root cause is the use of Python's str.format() method with user-controlled format strings (CWE-134: Use of Externally-Controlled Format String). The on_formattedvalue handler constructs a format call fmt.format(__fstring__=val) where the format string content can be influenced by attacker input. As documented in Armin Ronacher's analysis of str.format dangers, this pattern allows attribute traversal and can expose sensitive data or enable code execution when combined with other techniques.

Attack Vector

The attack requires local access and the ability to provide malicious input that gets processed by ASTEVAL. An attacker crafts a specially formatted Python expression containing f-string syntax designed to:

1. Trigger attribute access on internal objects through format string specifications
2. Intentionally cause an AttributeError exception
3. Catch the exception and access its obj attribute
4. Use the returned object reference to traverse to sensitive attributes or methods

The vulnerability is exploited through crafted f-string expressions that abuse Python's format specification mini-language. The attacker provides input that accesses object attributes through format field names, then leverages exception handling to capture object references that should be sandboxed. This technique allows escaping ASTEVAL's intended security boundaries to execute arbitrary Python code.

For full technical details, see the GitHub Security Advisory GHSA-3wwr-3g9f-9gc7.

Detection Methods for CVE-2025-24359

Indicators of Compromise

• Unusual Python expressions containing nested attribute access patterns in ASTEVAL inputs
• Application logs showing AttributeError exceptions followed by unexpected object property access
• Evidence of f-string expressions with complex format specifications targeting internal attributes
• Attempts to access __class__, __globals__, __builtins__, or other sensitive Python attributes

Detection Strategies

• Monitor application logs for patterns indicative of format string exploitation attempts in ASTEVAL contexts
• Implement input validation to detect and block expressions containing suspicious attribute traversal patterns
• Deploy runtime application self-protection (RASP) to detect sandbox escape attempts
• Review code for ASTEVAL usage and audit input sources for potential attacker control

Monitoring Recommendations

• Enable verbose logging for applications using ASTEVAL to capture expression evaluation details
• Set up alerts for exception patterns that may indicate exploitation attempts
• Monitor for unexpected child processes or network connections from applications using ASTEVAL
• Audit dependency versions regularly to detect vulnerable ASTEVAL installations

How to Mitigate CVE-2025-24359

Immediate Actions Required

• Upgrade ASTEVAL to version 1.0.6 or later immediately
• Audit all applications using ASTEVAL to identify instances where user input reaches the evaluator
• Implement additional input validation layers before passing data to ASTEVAL
• Review application architecture to minimize exposure of ASTEVAL to untrusted input

Patch Information

The vulnerability is fixed in ASTEVAL version 1.0.6. The patch addresses the unsafe handling of FormattedValue AST nodes by modifying how the on_formattedvalue method processes format strings, eliminating the dangerous str.format() call pattern that enabled attribute traversal.

To upgrade, use pip:

pip install --upgrade asteval>=1.0.6

Verify the installed version:

pip show asteval | grep Version

Workarounds

• If immediate upgrade is not possible, implement strict input sanitization to reject expressions containing f-string syntax
• Wrap ASTEVAL execution in additional sandboxing such as restricted subprocess environments or containers
• Limit the scope of objects accessible within the ASTEVAL context to minimize exploitation impact
• Consider alternative expression evaluation libraries with stronger sandboxing guarantees for high-risk use cases