CVE-2020-22083
jsonpickle 1.4.1 RCE in decode
- CVSS 9.8
- CWE-502 Deserialization of Untrusted Data
- Input Validation and Sanitization
- Remote
** DISPUTED ** jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data.
- CVSS base score
- 9.8
- Published
- 2020-12-17
- OWASP
- A06 Vulnerable and Outdated Components
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Fixed by upgrading
- Yes
Solution
Update jsonpickle to version 2.0.0 or higher.
Vulnerable code sample
import pickle
import base64
def load_user_session(session_data):
"""Load user session - VULNERABLE to pickle RCE"""
try:
# Dangerous: pickle.loads can execute arbitrary code
decoded = base64.b64decode(session_data)
session = pickle.loads(decoded)
return session
except Exception:
return None
# Malicious payload example (DO NOT USE):
# payload = pickle.dumps(os.system('rm -rf /'))
# encoded = base64.b64encode(payload)Patched code sample
import json
import hmac
import hashlib
import secrets
from typing import Dict, Any, Optional
class SecureSessionManager:
def __init__(self, secret_key: str):
self.secret_key = secret_key.encode()
def create_session_token(self, session_data: Dict[str, Any]) -> str:
"""Create secure session token with HMAC"""
# Use JSON instead of pickle - only safe data types
json_data = json.dumps(session_data, sort_keys=True)
# Create HMAC signature for integrity
signature = hmac.new(
self.secret_key,
json_data.encode(),
hashlib.sha256
).hexdigest()
# Combine data and signature
token = f"{json_data}:{signature}"
return base64.b64encode(token.encode()).decode()
def load_user_session(self, session_token: str) -> Optional[Dict[str, Any]]:
"""Securely load user session with validation"""
try:
# Decode token
decoded = base64.b64decode(session_token).decode()
# Split data and signature
if ':' not in decoded:
return None
json_data, signature = decoded.rsplit(':', 1)
# Verify HMAC signature
expected_sig = hmac.new(
self.secret_key,
json_data.encode(),
hashlib.sha256
).hexdigest()
if not hmac.compare_digest(signature, expected_sig):
return None
# Parse JSON data (safe deserialization)
session_data = json.loads(json_data)
# Additional validation
if not isinstance(session_data, dict):
return None
return session_data
except Exception:
return None
# Secure usage
session_mgr = SecureSessionManager("your-secret-key")
token = session_mgr.create_session_token({"user_id": 123, "role": "user"})
session = session_mgr.load_user_session(token)Cite this entry
@misc{vaitp:cve202022083,
title = {{jsonpickle 1.4.1 RCE in decode}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2020},
note = {VAITP Python Vulnerability Dataset, entry CVE-2020-22083},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-22083/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::