GHSA-rj98-crf4-g69w: pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-2044

pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user

Moderate severity GitHub Reviewed Published Mar 7, 2024 to the GitHub Advisory Database • Updated Mar 7, 2024

Package

pip pgAdmin4 (pip)

Description

pgAdmin 4 uses a file-based session management approach. The session files are saved on disk as pickle objects. When a user performs a request, the value of the session cookie ‘pga4_session’ is used to retrieve the file, then its content is deserialised, and finally its signature verified.
The cookie value is split in 2 parts at the first ‘!’ character. The first part is the session ID (sid), while the second is the session digest.
The vulnerability lies in versions of pgAdmin prior to 8.4 where a method loads session files by concatenating the sessions folder - located inside the pgAdmin 4 DATA_DIR - with the session ID. Precisely, the two values are concatenated using the [‘os.path.join’] function. It does not set a trusted base-path which should not be escaped

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-2044
• pgadmin-org/pgadmin4#7258
• pgadmin-org/pgadmin4@4e49d75

Published to the GitHub Advisory Database

Mar 7, 2024