CVE-2025-61765

MEDIUM

python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-61765 has a selected CVSS score of 6.4 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use for internal communications. When Socket.IO servers are configured to use a message queue backend such as Redis for inter-server communication, messages sent between the servers are encoded using the `pickle` Python module. When a server receives one of these messages through the message queue, it assumes it is trusted and immediately deserializes it. The vulnerability stems from deserialization of messages using Python's `pickle.loads()` function. Having previously obtained access to the message queue, the attacker can send a python-socketio server a crafted pickle payload that executes arbitrary code during deserialization via Python's `__reduce__` method. This vulnerability only affects deployments with a compromised message queue. The attack can lead to the attacker executing random code in the context of, and with the privileges of a Socket.IO server process. Single-server systems that do not use a message queue, and multi-server systems with a secure message queue are not vulnerable. In addition to making sure standard security practices are followed in the deployment of the message queue, users of the python-socketio package can upgrade to version 5.14.0 or newer, which remove the `pickle` module and use the much safer JSON encoding for inter-server messaging.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 6, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

python-socketio

Browse miguelgrinberg / python-socketio
CVE List>= 0.8.0, < 5.14.0affected

python-socketio

Browse PyPI / python-socketio
GitHub Advisory0.8.0 to < 5.14.0 · Fixed in 5.14.0affected

Proofs of concept

1

Repository PoCs

GitHublocus-x64/CVE-2025-61765_PoCRepository PoCby locus-x641Exploit11 files

34.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains two Python scripts that construct and deliver malicious pickle payloads to exploit CVE-2025-61765, a remote code execution vulnerability in python-socketio. One script publishes payloads directly to a Redis message queue; the other sends them via HTTP to a webhook that forwards to Redis. Both scripts include payload classes that use __reduce__ to execute arbitrary shell commands on the target Socket.IO server upon deserialization.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates the disclosed CVE-2025-61765 pickle deserialization vulnerability against a target python-socketio server. The payloads execute commands on the target server to create evidence files, gather system information, and optionally install an SSH key. All behavior is consistent with the stated exploit and no concealed or misrepresented harm to the operator or unrelated systems was found.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwarepython-socketio
Attack typesRemote Code ExecutionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

Both Python scripts actively construct and deliver malicious pickle payloads designed to achieve remote code execution on a vulnerable python-socketio server. The code includes complete exploit logic: payload classes with __reduce__ for command execution, serialization with pickle.dumps, and delivery mechanisms (direct Redis publish or HTTP webhook). This is exploit code, not merely a scanner or writeup.

socketio_server/poc.py:19-25socketio_server/poc.py:113-125poc.py:66-89

Requirements

  • Attacker must have prior access to the Redis message queue used by the python-socketio multi-server deployment.README.md:3
  • The target python-socketio server must be configured to use a Redis backend and be subscribed to the targeted channel.socketio_server/poc.py:154-155

Observed behavior

  • Defines a PickleRCE class with a __reduce__ method that returns (subprocess.check_output, (command,)) to execute arbitrary commands upon deserialization.socketio_server/poc.py:19-25
  • Defines an EvidencePayload class that uses __reduce__ to execute a bash command creating files in /tmp/evidence/ to prove compromise.socketio_server/poc.py:27-45
  • Serializes payload objects with pickle.dumps and publishes them to a Redis channel, targeting python-socketio servers that will deserialize them via pickle.loads.socketio_server/poc.py:113-125
  • The second script (poc.py) sends the same serialized pickle payloads via HTTP POST to a /webhook endpoint, which then forwards them to Redis.poc.py:66-89
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
Payload withheldSSHBackdoorPayload in poc.py installs an operator-supplied SSH public key on the target server, which is the disclosed RCE impact.poc.py:19-36
Command Execution
Payload withheldEvidencePayload and InfoGatheringPayload in socketio_server/poc.py create evidence files and collect system information on the target server, consistent with the exploit demonstration.socketio_server/poc.py:27-65
Network Connection
Payload withheldThe default webhook server URL in poc.py is localhost, indicating the operator runs the receiving server locally. No external data exfiltration is present.poc.py:124
Review boundaries

What the analysis did not establish

  • Only 3 of 11 repository files were provided as text; 8 files are omitted. The omitted files may contain additional exploit variants, server code, or configuration.
  • The evidence packet reports complete_artifact_coverage: false, so the full artifact content is not available for analysis.
  • 8 files in the repository were not provided as text and were not analyzed; their content could contain additional behavior not visible in the reviewed evidence.
  • The review does not assess whether the exploit works as claimed or whether the target server is actually vulnerable.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

locus-x64/CVE-2025-61765_PoCCreated Vuln labCVE-2025-61765Compose · mixed

1 Compose manifest · 2 Dockerfiles · 4 services

View exploit
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment demonstrating CVE-2025-61765, a pickle deserialization vulnerability in python-socketio. It includes a Redis message broker, a vulnerable Socket.IO server, an edge server that acts as a webhook to publish payloads to Redis, and an attacker container that sends malicious pickle payloads to the edge server.

docker-compose.yml:1-86README.md:1-19

Lab assessment

Vulnerability lab

The README explicitly states it is a demo for CVE-2025-61765, a remote code execution vulnerability in python-socketio. The Dockerfiles, server code, and exploit scripts are all designed to set up and exploit this vulnerability in a controlled environment.

README.md:1-3Dockerfile.socketio_server:5socketio_server/server.py:1-228
Lab shapeCompose · mixed
Services4
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

redis

message broker

A Redis 7 Alpine container used as the message queue for Socket.IO server communication. It is not the target of the vulnerability.

docker-compose.yml:6-16

socketio_server

vulnerable target

A Python Socket.IO server using AsyncRedisManager, which automatically deserializes messages from Redis using pickle.loads(). This is the vulnerable component targeted by the exploit.

docker-compose.yml:19-40Dockerfile.socketio_server:1-30socketio_server/server.py:30-33

edge_server

webhook relay

A Flask application that receives HTTP POST requests with pickle payloads and publishes them to the Redis channel. It acts as an intermediary, allowing the attacker to inject payloads into Redis without direct Redis access.

docker-compose.yml:43-57Dockerfile.edge_server:1-28edge_server/app.py:1-125

attacker

exploit client

A Python container that runs poc.py to send malicious pickle payloads to the edge server's /webhook endpoint. It requires an SSH public key as an argument to create an SSH backdoor payload.

docker-compose.yml:60-76poc.py:1-168
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-61765

Supported by supplied evidence

The environment is explicitly labeled as a demo for CVE-2025-61765. The vulnerable server uses python-socketio with AsyncRedisManager, which is documented to use pickle.loads() for deserialization, matching the vulnerability description.

Dockerfile.socketio_server:5socketio_server/server.py:30-33README.md:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:11-13
  • The attacker must provide an SSH public key via --ssh-key or --ssh-key-file argument to poc.py.poc.py:120-123
  • The edge_server must be running and accessible at the URL specified by the attacker (default http://localhost:6000).poc.py:118

Evidence-described exercise path

  1. Start the environment with 'docker-compose up --build'. This builds and starts Redis, the vulnerable Socket.IO server, the edge server, and the attacker container.README.md:11-13
  2. The attacker container automatically runs poc.py, which sends malicious pickle payloads (including an SSH backdoor) to the edge server's /webhook endpoint.docker-compose.yml:72poc.py:1-168
  3. The edge server publishes the received payloads to the Redis 'socketio' channel.edge_server/app.py:47-65
  4. The vulnerable Socket.IO server receives the message from Redis and automatically calls pickle.loads() on the payload, executing the embedded commands (e.g., creating evidence files, installing an SSH backdoor).socketio_server/server.py:30-33poc.py:18-35
  5. Check the ./evidence directory on the host for files created by the exploit inside the socketio_server container.docker-compose.yml:37-38README.md:17-19
Safety-review evidence

Behaviors behind the stored safety assessment

Suspicious behavior

The attacker's poc.py includes an SSHBackdoorPayload class that writes a user-supplied SSH public key to /home/{username}/.ssh/authorized_keys on the target server. While this is a documented part of the exploit demonstration, it is a concrete host-impact action that modifies the target container's SSH configuration to enable persistent remote access. This goes beyond a simple proof-of-concept (e.g., creating a file in /tmp) and constitutes a real backdoor installation, which is a suspicious indicator even in a lab context.

poc.py:18-35

Indicators requiring review

  • The exploit payload SSHBackdoorPayload installs an SSH backdoor by appending a user-provided public key to authorized_keys, enabling persistent remote access to the compromised container.poc.py:18-35
Review boundaries

What the analysis did not establish

  • The socketio_server/poc.py file is present but not used in the main exercise path; the attacker uses the root-level poc.py instead.
  • The attacker container's entrypoint runs poc.py, but the command is 'tail -f /dev/null', which may cause the container to exit after the script finishes if not overridden.
  • The edge_server's README.md describes a generic Redis publisher, not its specific role in the CVE demo.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

5