CVE-2024-2044

What it actually does

The flaw is an unsafe deserialization issue reachable through session-handling logic combined with path traversal. A crafted session reference can cause the application to load a pickle object from an attacker-controlled or unintended location and deserialize it. Because Python pickle data can execute code during deserialization, successful exploitation can lead to arbitrary command execution in the security context of the web application. Based on the supplied description, Windows deployments are at greatest risk because unauthenticated attackers may be able to trigger loading of remote pickle objects; on POSIX/Linux systems, exploitation requires authentication and the ability to upload or place a malicious pickle object before triggering deserialization. The vulnerability affects pgAdmin versions up to and including 8.3 per the description; the supplied affected package metadata also identifies pi-hole/adminlte Git content fixed at commit a66d859aecb427faad6adfce144fd97fbeb26a13, so teams should validate product applicability in their SBOMs and dependency inventories.

Why it matters to the business

Successful exploitation gives an attacker control over the affected application server, which can result in database administration compromise, credential theft, data exposure, service disruption, lateral movement, and deployment of additional malware. The risk is urgent because the issue has a critical CVSS score of 9.9, a high EPSS probability of 0.79326, and is marked weaponized, even though it is not currently listed in CISA KEV and is not flagged as ransomware-associated in the supplied data. Since the vulnerability was published over two years ago, exposed unpatched instances should be treated as likely discoverable by commodity scanners and opportunistic attackers.

How an attack unfolds

An attacker first identifies an exposed vulnerable web interface and determines whether it is running an affected version. On Windows, the attacker can attempt to abuse path traversal in session handling so the application retrieves a malicious pickle object from an attacker-controlled or unintended remote path without prior authentication. On POSIX/Linux, the attacker typically needs valid credentials or another way to place a malicious pickle object on the server, then manipulates the session-handling path so the application reads that object. When the vulnerable code deserializes the crafted pickle, embedded execution logic runs as the web application process. The attacker then commonly establishes persistence, runs reconnaissance commands, accesses configuration files and stored credentials, pivots toward managed databases or adjacent systems, and may deploy web shells, reverse shells, or malware depending on objectives.

How to fix it

Upgrade affected pgAdmin deployments to a version newer than 8.3 or the vendor-designated fixed release. For environments using the supplied pi-hole/adminlte Git package metadata, update to commit a66d859aecb427faad6adfce144fd97fbeb26a13 or a later trusted revision that contains the fix. Remove or rotate any exposed session files and invalidate active sessions after patching. Where immediate patching is not possible, restrict access to the administration interface using VPN, private networks, IP allowlisting, or authenticated reverse proxies; disable public exposure; enforce strong authentication; prevent arbitrary file uploads; block outbound SMB/WebDAV or other remote file retrieval from the application server where not required; and run the application with a least-privileged service account. Because exploitation can expose database credentials and administrative secrets, rotate credentials stored or used by the affected application if compromise is suspected.

How to confirm the fix worked

Confirm the installed product version is not pgAdmin 8.3 or earlier and that any tracked pi-hole/adminlte Git dependency includes commit a66d859aecb427faad6adfce144fd97fbeb26a13 or a later fixed revision. Validate with package managers, container image manifests, SBOMs, Git commit history, and application about/version pages. Review configuration to ensure the admin interface is not unnecessarily internet-exposed. Confirm session storage no longer deserializes untrusted pickle data and that path traversal sequences cannot influence session file resolution. Perform a safe, non-destructive negative test by sending benign traversal patterns to session-related endpoints and verifying the application rejects them, logs the attempt, and does not attempt to open unexpected local or remote paths. After remediation, restart the application, clear server-side sessions, and verify no new suspicious deserialization or path traversal errors appear in logs.

Typical attack path

1. Find an internet-accessible or internally reachable vulnerable pgAdmin or affected downstream web administration interface.
2. Fingerprint the product and version, or infer vulnerability from behavior and exposed routes.
3. Craft a session-related request that abuses path traversal to influence which serialized session object is loaded.
4. On Windows, point the vulnerable session loader toward a malicious remote pickle object where applicable.
5. On POSIX/Linux, authenticate or otherwise gain the ability to upload or place a malicious pickle object, then trigger deserialization through session handling.
6. Achieve code execution as the application service account when the pickle object is deserialized.
7. Run discovery commands, read application configuration, and harvest secrets such as database credentials, API keys, or session material.
8. Use the compromised application server to access managed databases, move laterally, install persistence, or disrupt operations.

How to detect it

Investigate web access logs, application logs, reverse proxy/WAF logs, operating system process creation telemetry, EDR alerts, file integrity monitoring, and network egress logs. In HTTP logs, look for session-related requests containing path traversal sequences such as ../, ..\, URL-encoded traversal, UNC paths, or references to remote file locations. In application logs, search for Python pickle errors, unexpected session loading failures, file-not-found errors referencing unusual paths, and deserialization stack traces. On Windows, pay special attention to outbound SMB/WebDAV attempts and requests referencing UNC paths, because the supplied description indicates unauthenticated remote pickle loading may be possible. On Linux/POSIX, correlate suspicious authenticated activity with file uploads followed by deserialization errors or web application child processes. In EDR/process telemetry, look for the web server or Python application process spawning command interpreters, scripting engines, network utilities, or database clients unexpectedly. On disk, inspect server-side session directories, upload directories, temporary directories, and application working directories for recently created pickle-like files, files with high-entropy or binary content masquerading as sessions, or artifacts owned by the web application user. If suspicious activity is found, preserve logs and disk artifacts, isolate the host, rotate credentials, and review downstream database access logs for unauthorized queries or administrative actions.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• file://
• \\\\
• pickle.UnpicklingError
• UnpicklingError
• invalid load key
• Ran out of input
• No module named 'copy_reg'
• _pickle
• cPickle
• posix.system
• nt.system
• os.system
• subprocess.Popen
• __reduce__
• __reduce_ex__
• cmd.exe /c
• powershell.exe -nop
• powershell.exe -enc
• /bin/sh -c
• /bin/bash -c
• .pkl
• .pickle
• sessions/
• session:

What your security team should do

• Prioritize patching or upgrading immediately because exploitation is weaponized and EPSS is high, even though the issue is not currently in CISA KEV.
• Inventory all pgAdmin deployments, containers, appliances, and downstream packages that may embed the affected session-handling code; include the supplied pi-hole/adminlte Git dependency in SBOM checks.
• Remove public exposure of administrative interfaces and require VPN, private network access, or a hardened access proxy.
• Hunt for prior exploitation before and after patching, focusing on path traversal attempts, pickle deserialization errors, suspicious child processes spawned by the web application, and unexpected outbound connections.
• Invalidate active sessions and rotate application, database, and service credentials if exploitation cannot be ruled out.
• Block unnecessary outbound SMB, WebDAV, and file-sharing protocols from affected servers, especially on Windows where remote pickle loading is described as unauthenticated.
• Review file upload permissions and server-side session storage locations for unexpected .pickle, .pkl, or anomalous session files.
• Add SIEM detections for traversal strings, pickle-related deserialization errors, and web application processes spawning shells or scripting interpreters.