dorosch

Path Traversal in Session Handling Leads to Unsafe Deserialization and Remote Code Execution (RCE)

Severity (CVSSv4)

9.2 CRITICAL - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Description

pgAdmin4 uses a file-based session management approach. The session files are saved on disk as pickle objects. When a user performs a request, the value of the session cookie pga4_session is used to retrieve the file, then it's content is deserialized, and finally its signature verified.

dorosch

import re
import logging
import argparse

import aiohttp
from bs4 import BeautifulSoup

import asyncio
import string
import itertools

dorosch

import os
import json
from glob import glob
from pathlib import Path
from datetime import datetime
from types import ModuleType
from typing import List, Type, Optional, Dict
from typing import Protocol
import importlib.util

dorosch

use std::net::{TcpListener, TcpStream};
use std::thread;
use std::sync::mpsc;
use std::io::Write;
use std::io::BufReader;
use std::io::BufRead;
use std::io::BufWriter;
use std::io::ErrorKind;

dorosch

import abc

from django.core.exceptions import ValidationError


class BaseValidator(abc.ABC):
    """
    Base validator class for collect and run validations.

    Every method starting with 'validate_' will be considered validation.

dorosch

import VueRouter from 'vue-router'

import Index from './components/Index'
import Dashboard from './components/Dashboard'
import authentificate from './auth'


const routes = [
  { path: '/', name: 'index', component: Index, beforeEnter: check_if_auth },
  { path: '/', name: 'dashboard', component: Dashboard, beforeEnter: check_if_auth }

dorosch

from tkinter import Tk, Canvas, PhotoImage, mainloop


class Color:
    BLACK = '#000000'
    WHITE = '#ffffff'


class CustomCanvas(Canvas):
    """Class for drawing on canvas by pixels (simple as much as possible)

dorosch

from django import apps
from django import conf

from apps.database.models import Database


class DatabaseAppConfig(apps.AppConfig):
    """
    You can only supplement the list of standard database settings
    when loading the application, since during the first pass through

dorosch

import abc

from django.forms.models import model_to_dict


class Mapping(abc.ABC):
    model = None
    fields = {}

    @classmethod

dorosch

from datetime import datetime

from rest_framework import serializers
from rest_framework.settings import api_settings


class TimestampField(serializers.Field):
    def to_internal_value(self, value):
        return datetime.utcfromtimestamp(
            int(value)