CVE-2024-2044

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/pgadmin-org/pgadmin4/issues/7258
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/
https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/

Configurations

No configuration.

History

01 Aug 2024, 13:49

Type	Values Removed	Values Added
CWE		CWE-31

23 Mar 2024, 03:15

Type	Values Removed	Values Added
References		() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/ -

13 Mar 2024, 17:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~4.6~~	v2 : unknown v3 : 9.9
References		() https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/ -
Summary	(en) pgAdmin 4 uses a file-based session management approach. The session files are saved on disk as pickle objects. When a user performs a request, the value of the session cookie 'pga4_session' is used to retrieve the file, then its content is deserialised, and finally its signature verified. The cookie value is split in 2 parts at the first '!' character. The first part is the session ID (sid), while the second is the session digest. The vulnerability lies in versions of pgAdmin prior to 8.4 where a method loads session files by concatenating the sessions folder - located inside the pgAdmin 4 DATA_DIR - with the session ID. Precisely, the two values are concatenated using the ['os.path.join'] function. It does not set a trusted base-path which should not be escaped	(en) pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

08 Mar 2024, 14:02

Type	Values Removed	Values Added
Summary		(es) pgAdmin 4 utiliza un enfoque de gestión de sesiones basado en archivos. Los archivos de sesión se guardan en el disco como objetos pickle. Cuando un usuario realiza una solicitud, el valor de la cookie de sesión 'pga4_session' se utiliza para recuperar el archivo, luego se deserializa su contenido y finalmente se verifica su firma. El valor de la cookie se divide en 2 partes en el primer '!' personaje. La primera parte es el ID de la sesión (sid), mientras que la segunda es el resumen de la sesión. La vulnerabilidad radica en las versiones de pgAdmin anteriores a la 8.4, donde un método carga archivos de sesión concatenando la carpeta de sesiones, ubicada dentro de pgAdmin 4 DATA_DIR, con el ID de sesión. Precisamente, los dos valores se concatenan usando la función ['os.path.join']. No establece una ruta base confiable de la que no se debe escapar

07 Mar 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-07 21:15

Updated : 2024-08-01 13:49

NVD link : CVE-2024-2044

Mitre link : CVE-2024-2044

CVE.ORG link : CVE-2024-2044

JSON object : View

Products Affected

No product.

CWE

CWE-31

Path Traversal: 'dir\..\..\filename'

9.9 /10