RPyC (Remote Python Call) is a Python library that enables transparent remote procedure calls, allowing clients to invoke methods on server-side Python objects over a network. In versions prior to 6.0.0, a critical vulnerability (CVE-2024-27758) exists when the server exposes methods that invoke the __array__ attribute on client-provided netref objects. This commonly occurs in scenarios where the server calls numpy's np.array() on a netref object received from the client. The vulnerability stems from insufficient validation and unsafe handling of client-supplied objects, allowing an attacker to craft a malicious class that, when accessed via __array__, triggers arbitrary code execution on the server. The CVSS 3.1 base score is 8.4 (high), reflecting the ease of exploitation (low attack complexity, no privileges or user interaction required) and the severe impact on confidentiality, integrity, and availability. The attack vector is local network (AV:L), meaning the attacker must have network access to the RPyC server. This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). No patches or fixes are currently linked, but upgrading to RPyC 6.0.0 or later is recommended. No known exploits are publicly reported yet, but the vulnerability poses a significant risk to environments using RPyC for remote Python execution, especially in scientific computing or distributed systems.

Successful exploitation of CVE-2024-27758 allows remote attackers to execute arbitrary code on the RPyC server, leading to full system compromise. This can result in unauthorized data access or modification, disruption of services, and potential lateral movement within an organization's network. Since RPyC is often used in scientific and distributed computing environments, the vulnerability threatens the confidentiality and integrity of sensitive data and computational results. The availability of affected systems can also be impacted if attackers deploy destructive payloads or ransomware. The lack of required authentication and user interaction lowers the barrier for attackers with network access, increasing the risk of exploitation in internal networks or exposed services. Organizations relying on RPyC for remote Python execution should consider this vulnerability critical to their operational security.

1. Upgrade RPyC to version 6.0.0 or later, where this vulnerability is addressed. 2. If immediate upgrade is not possible, restrict network access to RPyC servers using firewalls or network segmentation to trusted clients only. 3. Implement strict input validation and sanitization on all client-provided objects before invoking methods like __array__. 4. Avoid exposing server methods that directly call __array__ or other special attributes on client-supplied netref objects. 5. Monitor network traffic and logs for unusual or unexpected remote procedure calls that may indicate exploitation attempts. 6. Employ runtime application self-protection (RASP) or endpoint detection and response (EDR) tools to detect anomalous code execution patterns. 7. Educate developers and administrators about the risks of exposing unsafe remote methods and enforce secure coding practices in distributed Python applications.