CVE-2013-5093
Graphite 0.9.5-0.9.10 - Remote Code Execution via Unsafe Pickle Deserialization
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-5093.
PoCs published by Metasploit, Charlie Eriksen, funkypickle, including Metasploit module exploits/unix/webapp/graphite_pickle_exec.
AI-analyzed exploit summary This Metasploit module exploits a remote code execution vulnerability in Graphite Web (versions 0.9.5 to 0.9.10) by sending a malicious pickle payload via HTTP POST to the 'render' endpoint. The payload leverages Python's pickle deserialization to execute arbitrary commands.
Description
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Exploits (2)
This Metasploit module exploits a remote code execution vulnerability in Graphite Web (versions 0.9.5 to 0.9.10) by sending a malicious pickle payload via HTTP POST to the 'render' endpoint. The payload leverages Python's pickle deserialization to execute arbitrary commands.
This Metasploit module exploits a remote code execution vulnerability in Graphite Web (versions 0.9.5 to 0.9.10) via unsafe pickle deserialization. It sends a crafted payload to the 'render' endpoint, triggering arbitrary command execution.