CVE-2024-2044: pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user
pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them and gain code execution.
Published Mar 7, 2024 · Updated Aug 2, 2024
Affected packages
pgAdmin4
- Ecosystem
- PyPI
- Affected
- < 8.4
- Fixed in
- 8.4
- Check
pip show pgAdmin4
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them and gain code execution.
Credited to TheZ3ro.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-2044
- https://github.com/pgadmin-org/pgadmin4/issues/7258
- https://github.com/pgadmin-org/pgadmin4/commit/4e49d752fba72953acceeb7f4aa2e6e32d25853d
- https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV
- https://github.com/advisories/GHSA-rj98-crf4-g69w
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology