j0lt-github/python-deserialization-attack-payload-generator

j0lt-github/python-deserialization-attack-payload-generator

GitHubGitHub
GitHubgithub.com
Releases0
Stars132
Peas create serialized payload for deserialization RCE attack on python driven applications where pickle ,pyYAML, ruamel.yaml or jsonpickle module is used for deserialization of serialized data. I will update it with more attack vectors to targets other modules.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2020-22083↗
9.8 CRITICAL7.5 HIGH

jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data