CVE-2016-3957
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on web2py applications by exploiting insecure deserialization of session cookies. Attackers can craft malicious cookies that, when deserialized using Python's pickle.loads, execute arbitrary code on the server. All web2py applications using the default session handling with versions before 2.14.2 are affected.
💻 Affected Systems
- web2py
📦 What is this software?
Web2py by Web2py
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to steal sensitive data, modify application behavior, or use the server for further attacks.
If Mitigated
No impact if proper patching or workarounds are implemented to prevent insecure deserialization.
🎯 Exploit Status
Exploitation requires knowledge of the encryption_key, which may be guessable or obtainable through other means. Public exploit code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.14.2 and later
Vendor Advisory: https://github.com/web2py/web2py/releases/tag/R-2.14.2
Restart Required: Yes
Instructions:
1. Backup your application. 2. Update web2py to version 2.14.2 or later. 3. Restart the web2py application server. 4. Regenerate session cookies for all users.
🔧 Temporary Workarounds
Change encryption_key
allChange the encryption_key in your application configuration to invalidate existing malicious cookies.
Edit your application's models/db.py or appconfig.ini to set a new encryption_key
Disable pickle-based session handling
allModify session handling to use JSON or other safe serialization instead of pickle.
Modify gluon/utils.py to replace pickle.loads with json.loads in secure_load function
🧯 If You Can't Patch
- Implement WAF rules to block requests with suspicious cookie patterns
- Monitor logs for unusual session activity and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check web2py version: if version < 2.14.2, you are vulnerable. Also check if secure_load function in gluon/utils.py uses pickle.loads.Check Version:
python -c "import gluon; print(gluon.__version__)" or check web2py/VERSION fileVerify Fix Applied:
Verify web2py version is 2.14.2 or later and that secure_load function no longer uses pickle.loads for deserialization.📡 Detection & Monitoring
Log Indicators:
- Unusual session creation patterns
- Multiple failed session validations
- Requests with unusually large or malformed cookies
Network Indicators:
- HTTP requests with base64-encoded pickle objects in cookies
- Unusual outbound connections from web2py server
SIEM Query:
source="web2py" AND (cookie="*gAS*" OR cookie="*pickle*" OR cookie_length>1000)🔗 References
- https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/
- https://github.com/web2py/web2py/blob/R-2.14.1/gluon/utils.py#L200
- https://usn.ubuntu.com/4030-1/
- https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/
- https://github.com/web2py/web2py/blob/R-2.14.1/gluon/utils.py#L200
- https://usn.ubuntu.com/4030-1/
