CVE-2022-35411
CRITICALrpc.py < 0.6.0 - Unauthenticated Remote Code Execution via Pickle Deserialization
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2022-35411. PoCs published by Elias Hohl, CSpanias, fuzzlove.
AI-analyzed exploit summary This exploit leverages insecure deserialization in rpc.py (versions 0.4.2 to 0.6.0) by sending a malicious pickle payload to execute arbitrary commands. The payload abuses Python's pickle deserialization to trigger `os.system` with attacker-controlled input.
Description
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
Exploits (5)
This exploit leverages insecure deserialization in rpc.py (versions 0.4.2 to 0.6.0) by sending a malicious pickle payload to execute arbitrary commands. The payload abuses Python's pickle deserialization to trigger `os.system` with attacker-controlled input.
This repository contains a functional exploit for CVE-2022-35411, targeting unauthenticated RCE in rpc.py via unsafe pickle deserialization. The exploit includes a reverse shell payload and a dry-run mode for testing.
This repository contains a functional exploit for CVE-2022-35411, leveraging insecure deserialization in rpc.py versions 0.4.2 to 0.6.0. The exploit uses Python's pickle module to craft a malicious payload that achieves remote code execution (RCE) via the 'serializer' header.
This repository contains a functional exploit for CVE-2022-35411, targeting a deserialization vulnerability in rpc.py versions 0.4.2 to 0.6.0. The exploit leverages Python's pickle deserialization to achieve unauthenticated remote code execution (RCE) by sending a crafted payload to the vulnerable endpoint.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H