Leaked Session Key Leads to Remote Code Execution

[Miserlou]

[[Can somebody please sanity check this for me? I found this while reading the "session" code trying to debug something else. ]]

If a Pyramid session key gets leaked somehow (maybe a server is running in Debug mode) - because of how session handling uses the pickle serializer, this can lead to remote code execution (rather than just man in the middle attacks on users).

The problem code is here:

            cookieval = request.cookies.get(self._cookie_name)
            if cookieval is not None:
                try:
value = serializer.loads(bytes_(cookieval))

If I am an attacker with the key, I can simply sign my attack code, pickle it up, and the server will execute it, leading to complete and total pwn.

The solution is simple: replace pickle with a safe serializer. Django made this change in version 1.6 for this exact reason:

"If you’re using the signed cookie session backend and SECRET_KEY is known by an attacker (there isn’t an inherent vulnerability in Django that would cause it to leak), the attacker could insert a string into his session which, when unpickled, executes arbitrary code on the server. The technique for doing so is simple and easily available on the internet. Although the cookie session storage signs the cookie-stored data to prevent tampering, a SECRET_KEY leak immediately escalates to a remote code execution vulnerability."

Maybe I'm wrong here, but it seems like the safe thing to do would be to move away from pickle to JSON (or something faster but still safe) regardless.

[Miserlou]

A brief Googledork also reveals that the internets are full of leaky servers that are vulnerable to this.

[digitalresistor]

This is a known issue.

#2709
#827

Also, what does the application running in debug mode have to do with it? If you mean with the debugtoolbar... then you already have remote code execution through the debugtoolbar itself (we don't recommend having the debugtoolbar enabled on production sites).

Yes, if your session cookie key is leaked somehow, you are vulnerable to remote code execution.

[mmerickel]

Yes, losing any secret key will allow very terrible things to happen to whatever was relying on that secret key.