Description
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://packetstormsecurity.com/files/167872/rpc.py-0.6.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/abersheeran/rpc.py/commit/491e7a841ed9a754796d6ab047a9fb16e23bf8bdPatch, Third Party Advisory
- https://github.com/ehtec/rpcpy-exploitExploit, Third Party Advisory
- https://medium.com/%40elias.hohl/remote-code-execution-0-day-in-rpc-py-709c76690c30Exploit
- http://packetstormsecurity.com/files/167872/rpc.py-0.6.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/abersheeran/rpc.py/commit/491e7a841ed9a754796d6ab047a9fb16e23bf8bdPatch, Third Party Advisory
- https://github.com/ehtec/rpcpy-exploitExploit, Third Party Advisory
- https://medium.com/%40elias.hohl/remote-code-execution-0-day-in-rpc-py-709c76690c30Exploit
Timeline
- Published
- Jul 8, 2022
- Last modified
- Jun 17, 2026
- NVD status
- Modified