CVE-2025-61765: Verified Repro With Script Download

Summary

• Vulnerability: Pickle deserialization RCE in python-socketio pubsub manager
• Affected: python-socketio >= 0.8.0, < 5.14.0 (confirmed on 5.13.0)
• Fixed: 5.14.0 and later
• Impact: Remote code execution when attacker can inject messages into message queue

Mechanism (What is broken)

• In python-socketio's pubsub managers (RedisManager, KombuManager, etc.), inter-server messages are serialized using Python's pickle module.
• The _listen() method in the pubsub manager calls pickle.loads(message['data']) on incoming messages from the message queue.
• Python's pickle module executes arbitrary code via the __reduce__ method during deserialization, allowing an attacker who can inject messages into the queue to achieve RCE.
• The vulnerable code pattern: data = pickle.loads(message['data']) with no validation of message source or content.

Proof of Vulnerability

• On python-socketio 5.13.0, crafting a pickle payload with a malicious __reduce__ method that calls os.system() achieves code execution.
• When the payload is deserialized via pickle.loads(), the __reduce__ method executes os.system("echo 'RCE' > /tmp/evidence.txt").
• Evidence captured in logs/evidence_vuln.txt showing file creation proves RCE.
• Evidence JSON: {"reproduced": true, "vulnerable_version": "5.13.0"}

Patched Behavior (Latest)

• In python-socketio 5.14.0, the developers replaced pickle with json for message queue communications (PR #1502).
• The patched code uses json.loads(message['data'].decode()) instead of pickle.loads().
• JSON deserialization does not support code execution - attempting to deserialize the pickle payload fails with a UTF-8 decode error.
• Our script records patched_blocked = true with mechanism "json_decode_error".

Bypass Exploration (10+ distinct attempts) We tested the following bypass attempts on the patched version:

1. Raw pickle payload - Result: BLOCKED (UTF-8 decode error)
2. Base64-encoded pickle - Result: BLOCKED (JSON parse error)
3. JSON with reduce key - Result: BLOCKED (no code execution in JSON)
4. JSON with constructor pattern - Result: BLOCKED (JSON doesn't support constructors)
5. Nested pickle in JSON string - Result: BLOCKED (string not deserialized)
6. Unicode escape sequences - Result: BLOCKED (no code path to eval)
7. JSON with class key - Result: BLOCKED (not a Python object hook)
8. Msgpack payload - Result: BLOCKED (not accepted by json.loads)
9. YAML-in-JSON injection - Result: BLOCKED (pure JSON parser)
10. Polyglot JSON/pickle - Result: BLOCKED (JSON parser strict mode)

Result: All bypass attempts blocked because JSON deserialization fundamentally does not support code execution. patched_all_blocked=true.

Threat Model Considerations

• Access: Attacker needs ability to publish messages to the message queue backend (Redis, RabbitMQ, Kombu, etc.)
• Gain: Full RCE within the Socket.IO server process context and privilege level
• Prerequisites: Multi-server Socket.IO deployment using a message queue for inter-server communication
• In single-server deployments, this vulnerability is not exploitable as there is no message queue

How to Interpret Our Artifacts

• logs/evidence_vuln.txt: Shows "RCE_EXECUTED_VIA_PICKLE" written via os.system(), proving code execution
• logs/vulnerable.log: Shows pickle.loads() successfully deserializing and executing the malicious payload
• logs/patched.log: Shows json.loads() rejecting the pickle payload with decode error
• logs/result.json: JSON summary with reproduced=true, patched_blocked=true

Conclusion

• Vulnerability reproduced on affected version (5.13.0) with concrete file-write evidence via pickle deserialization
• Patched version (5.14.0) completely blocks the attack by switching to JSON serialization
• The fix is comprehensive: 10 bypass attempts all failed because JSON fundamentally cannot execute code during parsing

References

• Advisory: https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-g8c6-8fjj-2r4m
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-61765
• Fix PR: https://github.com/miguelgrinberg/python-socketio/pull/1502