CyberWatch
Expert Insights
Events & Webinars
Press
Emerging Voices CyberWatch 
|
.
CyberWatch

R Programming Language Vulnerable to Attack

By

Matthew Fagan, Access Point Consulting

By

Access Point Consulting

Summary

A vulnerability present in the R programming language on versions 1.4.0 through 4.4.0., categorized as CVE-2024-27322 (CVSSv3: 8.8), allows a remote attacker to send a maliciously crafted RDS-formatted file or R package to run arbitrary code on a user’s system. This vulnerability requires the user to interact with the RDS formatted file or R package. The research for this vulnerability comes from HiddenLayer.

Impact Assessment

Hidden Layer provides an in-depth assessment of the scope and impact of this vulnerability. According to their research, one of the functions that can be used to exploit this vulnerability appeared in GitHub repositories over 135,000 times. They believe it can be used in a supply chain attack because projects with vulnerable code are used from major software vendors such as R Studio, Facebook, Google, Microsoft, AWS, etc.

Exploitation of this vulnerability allows an attacker to execute arbitrary code remotely with user interaction using an RDS file or an R package.

What It Means for You

If you or your organization uses the R programming language in any capacity, performing an update to R v4.4.0 is paramount. Given the extensive research done and demos of exploitation by Hidden Layer, it is only a matter of time before a threat actor utilizes this vulnerability maliciously.

Remediation

Update R to version 4.4.0 or later for vulnerability remediation.

Business Implications

Exploitation of this vulnerability could affect a critical portion of the business. The R programming language is typically used with a wide variety of applications and services. If exploited, it could result in remote code execution with user interaction, which could greatly affect the business’ bottom line because the users of R often work with financial data. When this is the case, monetary and data losses are sure to follow an exploitation.

Access Point Consulting Recommends

Patch: Applying the patch to R to update to v 4.4.0 is the best method to mitigate this vulnerability.

Protect and train users: Due to this vulnerability requiring user interaction, it is important to monitor users and ensure malicious RDS formatted files or R packages reach these users. An advisory to users within your organization about this vulnerability is also recommended.

Associated Bulletins

https://jennhuck.github.io/workshops/install_update_R.html#Installing_RStudio

https://hiddenlayer.com/research/r-bitrary-code-execution/

https://nvd.nist.gov/vuln/detail/CVE-2024-27322

 

Resources

Latest Resources

April 10, 2025

Employing the Concept of “Continuity of Care” in Cybersecurity

My wife, Kelly, was a pediatric nurse, having worked in healthcare for over 30 years. I'm biased, but she always got high marks in her profession, from both her peers and from patients for whom she provided care. She provided a level of care that was absolutely critical to ensure patients receive consistent, high-quality treatment across all stages of care. The importance of documentation, communication and a continuity of care was imperative – children’s lives depended on it. But what does continuity of care look like outside the world of healthcare? In the realm of cybersecurity consulting, the principle of continuity is just as vital and plays a pivotal role in safeguarding organizations from evolving cyber threats.

Find out more

April 2, 2025

Scott "Monty" Montgomery (Island) | Navigating CMMC compliance for organizations of every size

Scott Montgomery, known as Monty, joined the CyberWatch Expert Series podcast to discuss his extensive background in cybersecurity, particularly in building and designing network security tools for high-assurance environments like the Department of Defense (DoD) and the intelligence community. His experience includes significant tenure at McAfee (now Trellix), which led him to his current role at Island, where he focuses on innovative approaches to cybersecurity compliance.

Find out more

February 24, 2025

Access Point Consulting Announces MSSP Partnership with Fortinet

Access Point Consulting is pleased to announce that it has become a Fortinet Managed Security Services Provider (MSSP) partner. This partnership places Access Point Consulting among a select group of providers in the Mid-Atlantic region that can offer Fortinet security solutions as both a Certified Fortinet Partner and a Fortinet MSSP.

Find out more
Resources

CyberWatch

April 2, 2025

Scott "Monty" Montgomery (Island) | Navigating CMMC compliance for organizations of every size

Scott Montgomery, known as Monty, joined the CyberWatch Expert Series podcast to discuss his extensive background in cybersecurity, particularly in building and designing network security tools for high-assurance environments like the Department of Defense (DoD) and the intelligence community. His experience includes significant tenure at McAfee (now Trellix), which led him to his current role at Island, where he focuses on innovative approaches to cybersecurity compliance.

Find out more
March 19, 2025

Michael Sviben (DomainGuard) | Defending against phishing and building proactive security awareness

Cybersecurity threats evolve rapidly, and one tactic consistently rises above the rest: phishing. In this episode of CyberWatch, Michael Sviben, co-founder of DomainGuard, discusses why phishing remains so effective, how businesses and individuals become targets, and what you can do to stay vigilant.

Find out more
March 5, 2025

David Habib (Brightspot) | Building a culture of cybersecurity awareness

Cybersecurity awareness is often reduced to check-the-box training, but David Habib, CIO at Brightspot, argues that real security awareness isn’t about formal programs—it’s about making security part of a company’s culture. In this episode, he shares practical insights on how organizations can move beyond stale training sessions to create an engaged and security-conscious workforce.

Find out more

Peace of mind starts here, at Access Point Consulting

Meet with an Expert