Collected research

Memcached Command Injections at Pylibmc

Flask-Session builds its memcached key by concatenating a prefix with the session cookie value, so CRLF smuggled in through octal-quoted cookie escapes injects raw memcached commands. An attacker can store an arbitrary pickle under a chosen key and then load it as their own session, gaining remote code execution when the library unpickles it.

Record

Published by

btlfry.gitlab.io

Topic

Injection

In the archive

• Collected in the 2023 research round

Related sources

• demo application

Tags

• command-injection
• deserialization
• cookie
• rce
• flask
• python
• cache
• prior-art-extension
• owasp-a03-2021
• owasp-a07-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of btlfry.gitlab.io, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.