CVE-2019-17206
📋 TL;DR
This vulnerability allows remote code execution through insecure deserialization of pickled objects in Frost Ming's rediswrapper library. Attackers can execute arbitrary scripts on systems using vulnerable versions. Any application using rediswrapper before version 0.3.0 is affected.
💻 Affected Systems
- Frost Ming rediswrapper (Redis Wrapper)
📦 What is this software?
Redis Wrapper by Redis Wrapper Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the server, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution leading to data theft, service disruption, or installation of backdoors/malware.
If Mitigated
Limited impact if proper network segmentation, least privilege, and input validation are implemented.
🎯 Exploit Status
The vulnerability is in the deserialization mechanism, making exploitation straightforward for attackers familiar with Python pickle exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.0 and later
Vendor Advisory: https://github.com/frostming/rediswrapper/releases/tag/v0.3.0
Restart Required: Yes
Instructions:
1. Update rediswrapper to version 0.3.0 or later using pip: pip install rediswrapper>=0.3.0
2. Restart all services using rediswrapper
3. Verify the update with: pip show rediswrapper
🔧 Temporary Workarounds
Disable Pickle Deserialization
allModify code to avoid using the vulnerable deserialization functions in models.py
# Review and modify models.py to remove or secure pickle.loads() calls
🧯 If You Can't Patch
- Implement strict network controls to limit access to rediswrapper services
- Deploy application firewalls with deserialization attack detection rules
🔍 How to Verify
Check if Vulnerable:
Check if rediswrapper version is below 0.3.0 using pip show rediswrapper or inspect requirements.txtCheck Version:
pip show rediswrapper | grep VersionVerify Fix Applied:
Confirm rediswrapper version is 0.3.0 or higher and test deserialization functionality📡 Detection & Monitoring
Log Indicators:
- Unusual pickle deserialization errors
- Suspicious Python process execution
- Unexpected network connections from rediswrapper processes
Network Indicators:
- Malformed pickle data sent to rediswrapper endpoints
- Unexpected outbound connections from affected servers
SIEM Query:
source="*rediswrapper*" AND (event="pickle.loads" OR event="deserialization")🔗 References
- https://github.com/frostming/rediswrapper/compare/v0.2.1...v0.3.0
- https://github.com/frostming/rediswrapper/pull/1
- https://github.com/frostming/rediswrapper/releases/tag/v0.3.0
- https://github.com/frostming/rediswrapper/compare/v0.2.1...v0.3.0
- https://github.com/frostming/rediswrapper/pull/1
- https://github.com/frostming/rediswrapper/releases/tag/v0.3.0
