Arbitrary Code Execution Vulnerability in Scapy due to Unsafe Deserialization
Summary
GHSA-cq46-m9x9-j8w2: Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization. Affects scapy versions < 2.6.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Scapy is a powerful Python-based interactive packet manipulation program and library. It enables users to create, manipulate, send, and capture network packets. Scapy is widely used for network analysis, penetration testing, and security research. However, it has a vulnerability that allows attackers to execute arbitrary code through unsafe deserialization of session files.
Vulnerability Detail
An unsafe deserialization vulnerability exists in Scapy versions prior to 2.7.0. This vulnerability arises when a user loads a malicious session file using the '-s' option, which triggers the deserialization of untrusted data without validation. The deserialization process uses Python's pickle module, which can execute arbitrary code if the deserialized object contains malicious instructions. This poses a significant risk, as an attacker can craft a malicious '.pkl.gz' file that, when loaded, executes arbitrary Python code on the victim's machine.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the '-s' option to load session files in Scapy. This prevents the risk of executing malicious code from untrusted session files.
Conclusion
The arbitrary code execution vulnerability in Scapy due to unsafe deserialization poses a significant risk to users who load untrusted session files. It is crucial to update to version 2.7.0 or later to mitigate this risk. Users should also avoid using the '-s' option until they can ensure their version is secure.
See every vulnerability recorded for scapy →
FAQ
The vulnerability is an insecure deserialization issue that allows arbitrary code execution when a malicious session file is loaded.
If you are using Scapy version 2.6.1 or earlier, your version is affected by this vulnerability.
If you cannot update Scapy, refrain from using the '-s' option to load session files until you can apply the update.
No, the vulnerability requires local access to the machine to load the malicious session file.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It requires only the Pipfile.lock to function.
References
Related vulnerabilities
Recent vulnerabilities recorded for scapy.
