PT-2022-22812 · Rpc.Py · Rpc.Py
Abersheeran
·
Published
2022-07-08
·
Updated
2024-02-09
·
CVE-2022-35411
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
rpc.py versions through 0.6.0
Description
The issue allows Remote Code Execution because an unpickle occurs when the
serializer: pickle HTTP header is sent. Although JSON is the default data format, an unauthenticated client can cause the data to be processed with unpickle. The maintainer notes that rpc.py is not designed for an API open to the outside world, and external requests cannot reach rpc.py in real-world use.Recommendations
For versions through 0.6.0, as a temporary workaround, consider deleting
PickleSerializer from SERIALIZER NAMES and SERIALIZER TYPES to turn off pickle, using the following code:del SERIALIZER NAMES[PickleSerializer.name]
del SERIALIZER TYPES[PickleSerializer.content type]A fix exists on the
master branch.Exploit
Fix
Insufficiently Protected Credentials
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Rpc.Py