Executive brief
Beaker is a session and caching library used in Python web applications. The library uses Python's pickle module to deserialize data without validation, allowing attackers to execute arbitrary code if they can control the cached or session data that gets deserialized. This could lead to complete application compromise.
Technical details
The vulnerability is a deserialization flaw (CWE-502) in Beaker's handling of cached and session data. By default, the library uses Python's pickle serialization format, which is inherently unsafe when processing untrusted input. An attacker who can manipulate cached session data or influence what gets deserialized can craft malicious pickle payloads that execute arbitrary Python code during unpickling. This vulnerability affects all versions through 1.11.0. The attack requires access to the cached/serialized data store or the ability to influence session values.
Affected products
- Beaker Beaker through 1.11.0
Timeline
- 2020-06-26: disclosed
- 2022-05-05: advisory