CVE-2025-62703

Insecure deserialization in Fugue's RPC server allows remote code execution.

• CVSS 8.8
• CWE-502
• Input Validation and Sanitization
• Remote

Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server. The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. This issue has been patched via commit 6f25326.

CVE

CVE-2025-62703

CWE

CWE-502

CVSS base score

8.8

Published

2025-11-25

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Serialization Issues

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Fugue

Fixed by upgrading

Yes

Solution

Upgrade to Fugue version 0.9.3 or later.

from typing import Any
from flask import Flask, request
from werkzeug.serving import make_server
from cloudpickle import loads, dumps
import logging

def _decode(data: bytes) -> Any:
    return loads(data)

class VulnerableFlaskRPCServer:
    def __init__(self, host: str = "127.0.0.1", port: int = 8000):
        self._host = host
        self._port = port
        self._app = Flask(__name__)
        self._app.add_url_rule(
            "/",
            view_func=self._handle,
            methods=["POST"],
            strict_slashes=False,
        )
        log = logging.getLogger("werkzeug")
        log.setLevel(logging.ERROR)
        self._server = None

    def _handle(self) -> Any:
        try:
            obj = _decode(request.data)
            res = {"status": "success", "type": str(type(obj))}
        except Exception as e:
            res = {"status": "error", "message": str(e)}
        return dumps(res)

    def run(self) -> None:
        self._server = make_server(self._host, self._port, self._app, threaded=True)
        self._server.serve_forever()

    def stop(self) -> None:
        if self._server is not None:
            self._server.shutdown()

import hmac
import hashlib
import cloudpickle
from typing import Any

class FlaskRPCServer:
    def __init__(self, secret_key: str):
        if not secret_key:
            raise ValueError("A secret_key is required for secure RPC communication.")
        self._secret_key = secret_key.encode('utf-8')

    def _decode(self, data: bytes) -> Any:
        """
        Decodes data by first verifying its HMAC signature and then using
        cloudpickle to deserialize it. This prevents deserialization of
        data from untrusted sources.
        """
        sig_len = hashlib.sha256().digest_size
        if len(data) < sig_len:
            raise ValueError("Incoming data is too short to contain a signature.")

        sent_sig = data[:sig_len]
        payload = data[sig_len:]

        expected_sig = hmac.new(self._secret_key, payload, hashlib.sha256).digest()

        # Use hmac.compare_digest for a timing-attack-resistant comparison
        if not hmac.compare_digest(sent_sig, expected_sig):
            raise SecurityError("Invalid signature. Data may have been tampered with.")

        # Only deserialize the payload if the signature is valid
        return cloudpickle.loads(payload)

import cloudpickle
import os

class RCE:
    def __reduce__(self):
        cmd = 'touch /tmp/pwned'
        return (os.system, (cmd,))

payload = cloudpickle.dumps(RCE())

@misc{vaitp:cve202562703,
  title        = {{Insecure deserialization in Fugue's RPC server allows remote code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-62703},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-62703/}}
}