Affected Product
Product Name: EPyT-Flow
Component: EPyT
Affected Versions: All versions prior to the fixed release
Deployment Scope: All environments where EPyT-Flow processes untrusted JSON input
Severity Information
Severity: Critical
CVSS v3.1 Base Score: 10.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Impact: Complete compromise of confidentiality, integrity, and availability
Vulnerability Summary
A critical unsafe deserialization vulnerability has been identified in EPyT-Flow. During JSON parsing, user-controlled input is deserialized without sufficient validation. A specific JSON field allows dynamic loading and instantiation of Python classes. When this behavior is abused, arbitrary objects can be created at runtime, resulting in unintended execution paths.
Because object construction in Python can trigger system-level operations, this flaw enables remote code execution when crafted JSON payloads are processed. The vulnerability is reachable through network-exposed services or automated ingestion of JSON-based workflow definitions.
Technical Details
The vulnerable logic processes JSON data and checks for a field that specifies an object type. When this field is present, the application dynamically imports the specified module and instantiates the class using parameters directly supplied by the input.
During deserialization:
- No allowlist is enforced for safe object types
- No restriction exists on module imports
- Constructor execution occurs automatically
This behavior allows attackers to invoke classes that execute commands, spawn subprocesses, or perform file operations during instantiation. The execution takes place with the same privileges as the EPyT-Flow service.
Exploitation Scenario
Exploitation is performed by sending a crafted JSON payload to an endpoint or workflow loader that processes untrusted JSON. The payload specifies a malicious or dangerous class name and arguments designed to trigger command execution.
Once processed:
- Arbitrary commands may be executed on the host
- Files may be created or modified
- Reverse shells or persistence mechanisms may be deployed
Publicly discussed proof-of-concept techniques demonstrate exploitation paths. Any such material should be treated strictly for educational and defensive testing purposes only and executed only in isolated environments.
Proof of Concept Status
The vulnerability has been confirmed by multiple independent security researchers. Proof-of-concept demonstrations exist in the security community showing successful command execution via crafted JSON deserialization. No exploit code is included here. Use of any PoC must remain limited to controlled lab testing and security validation.
MITRE Mapping
CWE
- CWE-502: Deserialization of Untrusted Data
ATT&CK Techniques
- T1190: Exploit Public-Facing Application
- T1059: Command and Scripting Interpreter
- T1105: Ingress Tool Transfer (post-exploitation)
- T1083: File and Directory Discovery
Detection
Log Sources
- Web server logs (API gateways, reverse proxies)
- Application logs from EPyT-Flow
- Endpoint process execution logs
- EDR / XDR telemetry
- Network IDS / IPS logs
Network Detection Queries
Splunk (HTTP traffic)
index=web_logs
method IN ("POST","PUT")
AND ("\"type\"" OR "\"__type__\"")
AND ("json" OR "application/json")
Elastic KQL
http.request.method : ("POST" or "PUT")
and http.request.body : "*\"type\"*"
Suricata (HTTP body inspection)
alert http any any -> any any (
msg:"EPyT-Flow Suspicious JSON Deserialization Attempt";
flow:to_server,established;
content:"\"type\""; http_client_body;
sid:25632; rev:1;
)
Application Log Detection
Splunk
index=application_logs
("load_from_json" OR "deserialize" OR "importlib")
AND ("type" OR "class")
Elastic KQL
message : ("load_from_json" or "deserialize")
and message : ("type" or "import")
Endpoint Detection
Suspicious child process creation by Python
index=endpoint_logs
ParentProcessName="python"
AND (ProcessName="sh" OR ProcessName="bash" OR ProcessName="cmd.exe" OR ProcessName="powershell.exe")
Elastic KQL
process.parent.name : "python"
and process.name : ("sh" or "bash" or "cmd.exe" or "powershell.exe")
Indicators of Exploitation
- JSON payloads containing unexpected
typefields - Dynamic module import errors in application logs
- Python processes spawning shells or system utilities
- Unexplained outbound network connections
- Files created in temporary or application directories
Mitigation and Remediation
Immediate Actions
- Upgrade EPyT-Flow to the fixed version
- Block untrusted access to JSON ingestion endpoints
- Remove legacy workflows using unsafe deserialization
Long-Term Hardening
- Enforce strict allowlists for deserialized objects
- Eliminate dynamic imports from user input
- Run the service using least-privilege permissions
- Enable continuous monitoring for process anomalies
Patch and Upgrade
Official Patch / Upgrade Link (Vendor):
https://github.com/WaterFutures/EPyT-Flow/releases
Final Takeaway
This document is intended for defensive security awareness, detection engineering, and remediation planning. Any testing or reproduction of the vulnerability must be conducted in isolated environments and strictly for educational or security validation purposes.
