Arbitrary Code Execution via Pickle in DiskCache

Executive Summary

The vulnerability in DiskCache (python-diskcache) through version 5.6.3 arises because it uses Python's pickle module for serialization by default.

An attacker who has write access to the cache directory can exploit this by placing malicious pickle data. When the victim application reads from the cache, the malicious pickle data can trigger arbitrary code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution on the system running the vulnerable DiskCache version.

If an attacker can write to the cache directory, they can execute malicious code with the privileges of the application reading the cache, potentially leading to system compromise, data theft, or further attacks.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the DiskCache library (python-diskcache) version 5.6.3 or earlier is in use and if the cache directory is writable by untrusted users.

You can check for the presence and version of python-diskcache in your environment by running the following command in your Python environment:

• pip show diskcache

To check if the cache directory is writable by untrusted users, you can inspect the permissions of the cache directory used by your application. For example, on a Unix-like system, use:

• ls -ld /path/to/cache_directory

If the directory permissions allow write access to untrusted users, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting write access to the cache directory to trusted users only, preventing attackers from writing malicious pickle data.

Additionally, upgrading python-diskcache to a version later than 5.6.3 that addresses this vulnerability or configuring the library to avoid using pickle for serialization can help mitigate the risk.

If upgrading is not immediately possible, consider isolating the cache directory and monitoring it for unauthorized changes.

Useful 0 Not Useful 0