CVE-2013-5093 graphite-web is vulnerable to Remote Code Execution via renderLocalView function

What is CVE-2013-5093?

CVE-2013-5093 is a medium-severity unsafe deserialization vulnerability in n/a, published on 27 Sep 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.

Weakness: CWE-94

Which versions are affected by CVE-2013-5093?

3 open source packages ship an affected version, including graphite-web. It affects 1 product.

Products include Graphite Project Graphite.

How do I fix CVE-2013-5093?

Upgrade graphite-web to 0.9.11 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2013-5093 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-5093 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2017-18638 graphite.composer.views.send_email vulnerable to SSRF High 7.5
• CVE-2013-5942 graphite-web is vulnerable to Remote Code Execution Medium 6.8
• CVE-2013-5943 Cross-site scripting in n/a Medium 4.3
• CVE-2022-4728 Graphite Web Cookie cross site scripting Low 3.5
• CVE-2022-4729 Graphite Web Template Name cross site scripting Low 3.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2013-5903, DEBIAN-CVE-2013-5093, GHSA-m923-w2gj-v43g, PYSEC-2013-3.