New R Programming Vulnerability Exposes Projects to Supply Chain Attacks

A security vulnerability has been learned in the R programming language that could be exploited by a risk actor to make a destructive RDS (R Information Serialization) file this kind of that it benefits in code execution when loaded and referenced.

The flaw, assigned the CVE identifier CVE-2024-27322, “includes the use of guarantee objects and lazy analysis in R,” AI application security firm HiddenLayer mentioned in a reportreport shared with The Hacker Information.

RDS, like pickle in Python, is a structure utilised to serialize and help you save the condition of info structures or objects in R, an open-resource programming language applied in statistical computing, facts visualization, and equipment understanding.

This process of serialization – serialize() or saveRDS() – and deserialization – unserialize() and readRDS() – is also leveraged when conserving and loading R deals.

The root cause driving CVE-2024-27322 lies in the truth that it could direct to arbitrary code execution when deserializing untrusted info, as a result leaving customers exposed to supply chain attacks by specially crafted R packages.

An attacker wanting to weaponize the flaw could hence get benefit of the simple fact that R packages leverage the RDS format to preserve and load facts, resulting in automated code execution when the offer is decompressed and deserialized.

“R offers are susceptible to this exploit and can, consequently, be made use of as section of a provide chain attack through deal repositories,” the company explained. “For an attacker to acquire in excess of an R deal, all they will need to do is overwrite the rdx file with the maliciously crafted file, and when the package deal is loaded, it will quickly execute the code.”

The security defect has been tackled in edition 4.4. introduced on April 24, 2024, adhering to accountable disclosure.

“An attacker can exploit this [flaw] by crafting a file in RDS structure that contains a assure instruction placing the value to unbound_price and the expression to consist of arbitrary code,” HiddenLayer explained. “Owing to lazy evaluation, the expression will only be evaluated and run when the image related with the RDS file is accessed.”

“Thus if this is simply an RDS file, when a user assigns it a image (variable) in get to function with it, the arbitrary code will be executed when the consumer references that image. If the item is compiled inside an R offer, the deal can be included to an R repository these as CRAN, and the expression will be evaluated and the arbitrary code operate when a person masses that deal.”

Uncovered this post exciting? Follow us on Twitter  and LinkedIn to examine a lot more exceptional material we write-up.

Some parts of this post are sourced from:
thehackernews.com