Description
jsonpickle through 1.4.1 存在安全漏洞，该漏洞允许通过decode()函数在恶意负载反序列化期间远程执行代码。
Jsonpickle <=1.4.1 反序列化远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2020-22083
https://zone.ci/aliyun/ali_nvd/105952.html
https://github.com/jsonpickle/jsonpickle/issues/332
https://www.sentinelone.com/vulnerability-database/cve-2020-22083/
https://payatu.com/advisory/code-execution-json-pickle/
https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/
https://sourcery.ai/vulnerabilities/python-jsonpickle-deserialization-rce