-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability lies in the insecure deserialization of session files using Python's pickle module. The advisory points out that Scapy allows users to load session files via the -s command-line option, which triggers the deserialization of a user-controlled file.
The analysis of the provided patch commit 13621d1145b3435e9d03caf20997107a84435c0b confirms this. The patch entirely removes the session management feature, including the functions responsible for loading, saving, and updating sessions.
The key vulnerable functions identified are:
load_session: This function was the primary entry point for loading a session from a file. It directly used pickle.load() on the file path provided, which is the root cause of the vulnerability.init_session: This function was called on startup to initialize the Scapy session. It contained logic to load an existing session from a file using pickle.load(), making it another vector for the same vulnerability.update_session: This function was used to update an existing session from a file, and it also used pickle.load(), making it vulnerable.During exploitation, an attacker would craft a malicious .pkl.gz file containing a pickled object with a __reduce__ method that executes arbitrary commands. When a user loads this file in Scapy, the load_session or init_session function would be called, triggering the pickle.load() call and executing the malicious code. The profiler would show one of these functions in the stack trace at the time of exploitation. The mitigation was to completely remove this functionality, as seen in the commit, eliminating the vulnerable functions.
load_sessionscapy/main.py
init_sessionscapy/main.py
update_sessionscapy/main.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| scapy | pip | <= 2.6.1 |
Ongoing coverage of React2Shell