CVE-2024-2044
📋 TL;DR
pgAdmin versions up to 8.3 contain a path traversal vulnerability in session handling that allows unsafe deserialization of pickle objects, leading to remote code execution. On Windows, unauthenticated attackers can exploit this; on Linux/POSIX systems, authenticated attackers can exploit it. This affects all pgAdmin deployments running vulnerable versions.
💻 Affected Systems
- pgAdmin
📦 What is this software?
Fedora by Fedoraproject
Pgadmin 4 by Pgadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining remote code execution as the pgAdmin service account, potentially leading to database access, lateral movement, and data exfiltration.
Likely Case
Attackers exploit the vulnerability to execute arbitrary code on the pgAdmin server, potentially accessing PostgreSQL databases, installing malware, or using the server as a pivot point.
If Mitigated
With proper network segmentation and access controls, impact is limited to the pgAdmin server itself, though database credentials could still be compromised.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. Windows exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4 and later
Vendor Advisory: https://github.com/pgadmin-org/pgadmin4/issues/7258
Restart Required: Yes
Instructions:
1. Upgrade pgAdmin to version 8.4 or later. 2. Stop the pgAdmin service. 3. Install the updated version. 4. Restart the pgAdmin service. 5. Verify the version is 8.4+.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to pgAdmin to only trusted IP addresses or internal networks.
# Use firewall rules to restrict access
sudo ufw allow from 192.168.1.0/24 to any port 5050
# Or use iptables: sudo iptables -A INPUT -p tcp --dport 5050 -s 192.168.1.0/24 -j ACCEPT
Disable Pickle Session Storage
allConfigure pgAdmin to use alternative session storage mechanisms instead of pickle-based sessions.
# Edit pgAdmin config.py
SESSION_STORAGE = 'filesystem' # or 'redis', 'memcached'
# Ensure proper file permissions if using filesystem storage
🧯 If You Can't Patch
- Immediately restrict network access to pgAdmin server to only necessary users and systems.
- Implement application-level WAF rules to detect and block path traversal attempts and pickle deserialization patterns.
🔍 How to Verify
Check if Vulnerable:
Check pgAdmin version via web interface or configuration files. Versions 8.3 and below are vulnerable.Check Version:
pgadmin4 --version or check the version in the web interface footer.Verify Fix Applied:
Verify pgAdmin version is 8.4 or higher. Test that session handling no longer accepts pickle objects from untrusted paths.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in session directories
- Pickle deserialization errors or warnings
- Unauthenticated access attempts to session endpoints on Windows
Network Indicators:
- HTTP requests containing pickle objects or unusual session parameters
- Requests attempting path traversal patterns (../ sequences)
SIEM Query:
source="pgadmin.log" AND ("pickle" OR "session" OR "deserialize") AND (status!=200 OR method="POST" AND uri CONTAINS "session")🔗 References
- https://github.com/pgadmin-org/pgadmin4/issues/7258
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/
- https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/
- https://github.com/pgadmin-org/pgadmin4/issues/7258
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/
- https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/
