CVE-2013-5093: Remote Code Execution in Graphite-Web
Summary
CVE-2013-5093: graphite-web is vulnerable to Remote Code Execution via renderLocalView function. Affects graphite-web versions >= 0.9.5, < 0.9.11. Fixed in 0.9.11. How to fix ↓
Also tracked for
- graphite-web · Debian:12
The same CVE-2013-5093 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Graphite-Web is a web application that provides a user interface for the Graphite time series database. It allows users to visualize and analyze data stored in the database through interactive graphs and charts. The vulnerability identified as CVE-2013-5093 affects versions 0.9.5 through 0.9.10 of Graphite-Web. This vulnerability arises from the unsafe usage of the pickle Python module in the renderLocalView function of the render/views.py file. An attacker can exploit this vulnerability by crafting a serialized object, leading to the execution of arbitrary code on the target system.
Vulnerability Detail
The renderLocalView function in render/views.py in Graphite-Web uses the pickle Python module unsafely, allowing remote attackers to execute arbitrary code. By sending a specially crafted serialized object, an attacker can exploit this vulnerability and gain unauthorized access to the target system. This can result in various malicious activities, such as data theft, privilege escalation, or even complete system compromise. It is important to note that this vulnerability only affects versions 0.9.5 through 0.9.10 of Graphite-Web.
How To Fix
Minimum fixed version
0.9.11
This is the first release that contains the fix.
pip install --upgrade "graphite-web==0.9.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the functionality that utilizes the renderLocalView function. This can be achieved by modifying the code or configuration to prevent any calls to this vulnerable function. However, it is strongly advised to upgrade to the latest version as soon as possible to fully resolve the vulnerability.
Conclusion
The vulnerability identified as CVE-2013-5093 in Graphite-Web allows remote code execution, posing a significant security risk. It is crucial to upgrade to version 0.9.11 or later to mitigate this vulnerability. If immediate upgrading is not possible, a temporary workaround can be implemented by disabling the vulnerable functionality. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphite-web →
FAQ
Graphite-Web is a web application that provides a user interface for the Graphite time series database. It allows users to visualize and analyze data stored in the database through interactive graphs and charts.
This vulnerability allows remote attackers to execute arbitrary code on the target system. This can lead to unauthorized access, data theft, privilege escalation, or complete system compromise.
Versions 0.9.5 through 0.9.10 of Graphite-Web are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Graphite-Web to version 0.9.11 or later.
Yes, a temporary workaround can be implemented by disabling the functionality that utilizes the renderLocalView function. However, upgrading to the latest version is strongly advised.
Related vulnerabilities
Recent vulnerabilities recorded for graphite-web.
