CVE-2024-35058: 
Python vulnerability analysis and mitigation

An issue in the API wait function of NASA AIT-Core v2.5.2 was discovered that allows attackers to execute arbitrary code via supplying a crafted string. The vulnerability was disclosed on May 21, 2024 and assigned CVE-2024-35058 (NVD, GitHub Advisory).

The vulnerability exists in the API wait function of NASA AIT-Core which evaluates Python string expressions using the eval function. The wait function accepts conditions in various forms including Python string expressions, lambda, or functions, but processes them insecurely by passing them directly to eval without proper sanitization. This implementation allows for arbitrary code execution when malicious Python expressions are provided as input (LinkedIn Article).

The vulnerability allows attackers to achieve local code execution on systems running the affected version of NASA AIT-Core. When successfully exploited, an attacker can execute arbitrary Python code with the same privileges as the application process (GitHub Advisory).

The vulnerability is relatively straightforward to exploit as it only requires the ability to pass a crafted string to the API wait function. The CVSS v4.0 base score is 9.2 (Critical), indicating high exploitability with network attack vector, low attack complexity, and no privileges or user interaction required (GitHub Advisory).

Currently there are no patched versions available. As a general recommendation, organizations should avoid using the Python eval function for expression evaluation and instead utilize third-party libraries that provide similar functionality with proper input sanitization (LinkedIn Article).