Exploitation Summary
EIP tracks 2 public exploits for CVE-2021-33026. PoCs published by CarlosG13, Agilevatester.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-33026, demonstrating remote code execution via Pickle deserialization in Flask-Caching. The PoC crafts a malicious serialized object, stores it in Memcached, and triggers execution by sending a crafted session cookie to the target Flask application.
Description
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision
Exploits (2)
This repository contains a functional exploit for CVE-2021-33026, demonstrating remote code execution via Pickle deserialization in Flask-Caching. The PoC crafts a malicious serialized object, stores it in Memcached, and triggers execution by sending a crafted session cookie to the target Flask application.
This repository contains a functional exploit PoC for CVE-2021-33026, demonstrating a deserialization vulnerability in Flask-Caching. The exploit leverages pickle deserialization to achieve remote code execution (RCE) by poisoning a Redis or Memcached cache with a malicious payload.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H