-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyquokka | pip | <= 0.3.1 |
Miggo AIRoot Cause AnalysisThe analysis of the provided vulnerability description and the source code of pyquokka/flight.py confirms the presence of multiple remote code execution vulnerabilities within the FlightServer class. The root cause is the consistent use of pickle.loads() to deserialize data received from remote clients over the network. This is a classic example of CWE-502: Deserialization of Untrusted Data. An attacker can craft a malicious object, serialize it using pickle, and send it to the server. When the server deserializes this object using pickle.loads(), the malicious code within the object's __reduce__ method is executed, giving the attacker control over the server.
The vulnerability is not confined to a single function but is present across the primary methods responsible for handling client requests in the FlightServer:
FlightServer.do_action: This method has two vulnerable code paths. When handling the set_configs action, it directly deserializes the request body. Similarly, the cache_garbage_collect action also involves deserializing the request body.FlightServer.do_put: This method deserializes a portion of the request descriptor (descriptor.command), which is controlled by the client.FlightServer.do_get: This method deserializes the ticket provided by the client to retrieve data. It even contains a secondary deserialization call on a variable (input_requirements) obtained from the first deserialization, compounding the risk.All these functions are public methods of the FlightServerBase and are intended to be called by remote clients, making them direct entry points for an attack. The vulnerability is critical because it requires no authentication and can be triggered by any user who can connect to the FlightServer's network port.
A Semantic Attack on Google Gemini - Read the Latest Research