by Kastro
Paper/Archive/CVE-2024-9701

CVE-2024-9701

kedro-org kedro-org/kedro — Remote Code Execution in kedro-org/kedro

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.6.666 × 2013.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.

Affected

ProductAffectedFixed inSource
kedro-org/kedrounspecified – < 0.19.90.19.9CNA

Scores by source

@huntr_ai (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/96c77fef-93b2-4d4d-8cbe-57a718d8eea5refgithub.com/kedro-org/kedro/commit/d79fa51de55ac0ccb58cce1a482df1b445f0fe7c