Information disclosure: unhandled KeyError returns full Python stack trace for unknown fields in JSON-RPC (model.party.party.create)
Severity: Medium (information disclosure). Reveals internal file paths, function names and traceback, which aids reconnaissance. Summary: Supplying unexpected keys in a JSON-RPC create request (e.g., \_debug) causes a KeyError in the server, and the full Python traceback is returned in the JSON-RPC error response. This leaks internal implementation details (file paths, function names, library layout,) which can assist an attacker in further exploitation/reconnaissance. Impact: - Information disclosure of internal server implementation and file paths. - Helps an attacker identify code locations and shape more focused exploits (e.g., find vulnerable modules or confirm model field names). - It could be used to increase the impact of subsequent attacks or to craft DoS tests. Steps to reproduce: Log in to Tryton as any user, create a part, and capture the request in Burp. ![image.png](/uploads/2369bc09271279bba5de0a3b6c2654df/image.png){width=654 height=544} Send the request: ![image.png](/uploads/eb942ad276f473ee5ebd29daf50fcfc7/image.png){width=748 height=346}
issue