CVE-2022-35411: Deserialization of Untrusted Data in rpc-py
Summary
CVE-2022-35411: rpc.py vulnerable to Deserialization of Untrusted Data. Affects rpc-py versions >= 0.4.2, <= 0.6.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
rpc-py is a Python package that provides a remote procedure call (RPC) framework. It allows communication between different processes or systems by invoking functions remotely. The package supports various data serialization formats, including JSON and Pickle. However, a vulnerability has been discovered in versions up to 0.6.0, where an unauthenticated client can cause the data to be processed with unpickle, leading to potential remote code execution.
Vulnerability Detail
The vulnerability (CVE-2022-35411) in rpc-py arises due to improper handling of untrusted data during deserialization. By sending a specially crafted HTTP header with the value "serializer: pickle", an attacker can trigger the use of the pickle serializer instead of the default JSON serializer. This allows the attacker to execute arbitrary code on the server. It is important to note that rpc-py is not designed for use in open APIs, and in real-world scenarios, external requests cannot reach rpc-py. However, if rpc-py is exposed to untrusted clients, this vulnerability poses a significant risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating to the latest version is not feasible, a workaround can be implemented by disabling the use of the pickle serializer. This can be achieved by removing the pickle serializer from the list of available serializers. Here is an example code snippet that demonstrates the workaround:
from rpcpy.serializers import SERIALIZER_NAMES, SERIALIZER_TYPES
# Remove pickle serializer
if 'pickle' in SERIALIZER_NAMES:
del SERIALIZER_NAMES['pickle']
if 'application/x-pickle' in SERIALIZER_TYPES:
del SERIALIZER_TYPES['application/x-pickle']
Conclusion
The vulnerability (CVE-2022-35411) in rpc-py allows for the deserialization of untrusted data, potentially leading to remote code execution. It is crucial to update rpc-py to the latest version or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rpc-py →
FAQ
rpc-py is a Python package that provides a remote procedure call (RPC) framework for inter-process communication.
Versions up to and including 0.6.0 of rpc-py are affected by this vulnerability.
The vulnerability allows an unauthenticated client to execute arbitrary code on the server, potentially leading to remote code execution.
No, rpc-py is not designed for use in open APIs. In real-world scenarios, external requests cannot reach rpc-py.
The vulnerability can be fixed by updating rpc-py to version 0.6.1 or later. Alternatively, you can implement the provided workaround to disable the use of the pickle serializer.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
