RCE in a Python sandbox — from the bot editor to the server shell

Quick answer

An AI platform let its users write bot logic in Python executed in a "sandbox." The sandbox didn't block the os module. Two lines (os.popen("env").read(), os.popen("whoami; uname -a").read()) were enough to run system commands, read internal environment variables and fingerprint the underlying runtime. Severity: Critical.

1. Context — what is the Python Sandbox?

The platform lets users create bots with custom logic by writing Python code directly in the app. This code runs in an environment called the "sandbox" when the bot receives messages.

The promise of the sandbox is that the code runs in a controlled, isolated environment. The bug found proves that that isolation doesn't exist: from the bot's Python code you can directly run operating-system commands on the server.

2. The bug — unrestricted shell access

The sandbox doesn't block the os module or the functions that let you run system commands. Specifically, os.popen() opens a shell subprocess and returns its output directly in the bot's response.

PoC A — Environment variables

import os
print(os.popen("env").read())

This code runs the env command on the server and returns all the process's environment variables. The observed output includes internal variables of the execution system and internal runtime paths (/__runtime/*), which reveal that the sandbox runs on a publicly known serverless Python platform.