You can deploy this model and start earning money today!

joekaw/
j0x-msgpack-rce

Name: j0x-msgpack-rce
Availability: InStock

vulnerability-poc

rce

messagepack

Views

No views yet

Vulnerability Disclosure: Critical RCE in MessagePack

Overview

This repository contains a proof-of-concept (PoC) for an Arbitrary Code Execution (ACE) vulnerability identified in the MessagePack deserialization process.

Target Format

.msgpack

Description

The application utilizes msgpack.unpack() on untrusted model/data files without strict type validation. By crafting a payload using MessagePack extension types, an attacker can instantiate and execute arbitrary system commands during the deserialization process.

Proof of Concept

The provided poc_messagepack.msgpack triggers os.system('echo ACE_TRIGGERED').

Steps to Reproduce

Install a vulnerable version of the target parser/library.
Execute the loader:
python
1import msgpack 2with open("poc_messagepack.msgpack", "rb") as f: 3 msgpack.unpack(f)
Observe the execution of the command.

Recommendation

Implement a strict allow-list for deserialized objects or transition to non-executable serialization formats.

Security Impact

Full remote code execution on the host machine during the model loading phase.

joekaw/j0x-msgpack-rce