CVE-2024-2044: 
Python vulnerability analysis and mitigation

CVE-2024-2044 affects pgAdmin versions 8.3 and earlier, exposing a path-traversal vulnerability in the session handling code during user session deserialization. The vulnerability was discovered in early 2024 and publicly disclosed on March 7, 2024. The issue impacts pgAdmin's server mode installations but does not affect desktop mode users (Shielder Advisory).

The vulnerability stems from pgAdmin's file-based session management approach where session files are stored as pickle objects on disk. When processing requests, pgAdmin uses the 'pga4_session' cookie value to retrieve and deserialize session files. The vulnerability exists in the FileBackedSessionManager.get method, which concatenates the sessions folder with the session ID using os.path.join without proper base-path validation. This implementation has two critical weaknesses: it fails to establish a trusted base-path that cannot be escaped, and it uses the rightmost absolute path as the root path. The vulnerability has received a CVSS v3.1 base score of 9.9 (Critical) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability allows attackers to force the server to deserialize pickle objects from arbitrary paths, potentially leading to remote code execution. The impact varies by operating system: on Windows, an unauthenticated attacker can load and deserialize remote pickle objects through UNC paths, while on POSIX/Linux systems, an authenticated attacker can upload and deserialize pickle objects to achieve code execution (Shielder Advisory).

The exploitability differs based on the operating system. On Windows systems, the vulnerability can be exploited pre-authentication by specifying a UNC path in the cookie and hosting a malicious pickle object on an unauthenticated SMB share. For Linux/POSIX systems, exploitation requires authentication and the ability to upload the malicious pickle object through pgAdmin's Storage Manager component (Shielder Advisory).

The primary mitigation is to upgrade to pgAdmin version 8.4 or later, which contains the security fix for this vulnerability. The patch was released on March 7, 2024, addressing the path traversal and unsafe deserialization issues (GitHub Issue, Fedora Update).