critical9.0Public exploit code
CVE-2013-5093
graphite-web is vulnerable to Remote Code Execution via renderLocalView function
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Graphite Web - Unsafe Pickle Handling (Metasploit)2013-08-21 · remote · unix · Verified
Impact
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | graphite-web | >= 0.9.5, <= 0.9.10 | 0.9.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Graphite Project | Graphite | Versions 0.9.5, 0.9.6, 0.9.7, 0.9.8, 0.9.9, 0.9.10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/
- http://secunia.com/advisories/54556
- http://www.exploit-db.com/exploits/27752
- http://www.osvdb.org/96436
- http://www.securityfocus.com/bid/61894
- https://github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rst
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/graphite_pickle_exec.rb
- https://github.com/advisories/GHSA-m923-w2gj-v43g
- https://nvd.nist.gov/vuln/detail/CVE-2013-5093
- https://github.com/graphite-project/graphite-web/blob/d39d455622127e479d8c4e7760311e3883cfd086/docs/releases/0_9_11.rst
- https://github.com/pypa/advisory-database/tree/main/vulns/graphite-web/PYSEC-2013-3.yaml
- https://web.archive.org/web/20200228174538/http://www.securityfocus.com/bid/61894
- http://ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory