joekaw/j0x-msgpack-rce

Vulnerability Disclosure: Critical RCE in MessagePack

Overview

This repository contains a proof-of-concept (PoC) for an Arbitrary Code Execution (ACE) vulnerability identified in the MessagePack deserialization process.

Target Format

.msgpack

Description

The application utilizes msgpack.unpack() on untrusted model/data files without strict type validation. By crafting a payload using MessagePack extension types, an attacker can instantiate and execute arbitrary system commands during the deserialization process.

Proof of Concept

The provided poc_messagepack.msgpack triggers os.system('echo ACE_TRIGGERED').

Steps to Reproduce

1. Install a vulnerable version of the target parser/library.
2. Execute the loader:

   import msgpack
   with open("poc_messagepack.msgpack", "rb") as f:
       msgpack.unpack(f)
   

3. Observe the execution of the command.

Recommendation

Implement a strict allow-list for deserialized objects or transition to non-executable serialization formats.

Security Impact

Full remote code execution on the host machine during the model loading phase.