Information disclosure: unhandled KeyError returns full Python stack trace for unknown fields in JSON-RPC (model.party.party.create)
Severity: Medium (information disclosure). Reveals internal file paths, function names and traceback, which aids reconnaissance.
Summary:
Supplying unexpected keys in a JSON-RPC create request (e.g., \_debug) causes a KeyError in the server, and the full Python traceback is returned in the JSON-RPC error response. This leaks internal implementation details (file paths, function names, library layout,) which can assist an attacker in further exploitation/reconnaissance.
Impact:
- Information disclosure of internal server implementation and file paths.
- Helps an attacker identify code locations and shape more focused exploits (e.g., find vulnerable modules or confirm model field names).
- It could be used to increase the impact of subsequent attacks or to craft DoS tests.
Steps to reproduce:
Log in to Tryton as any user, create a part, and capture the request in Burp.
{width=654 height=544}
Send the request:
{width=748 height=346}
issue