Listen to this Post
The vulnerability (CVE-2024-3159) in the Fickling security analysis tool stems from its process of converting Python pickle bytecode to an Abstract Syntax Tree (AST). During this conversion, the tool’s `GET` bytecode handler specifically omits emitting AST import nodes for modules identified as __builtin__, __builtins__, or builtins. This omission occurs even though these modules are explicitly listed in the `UNSAFE_MODULES` dictionary within the analysis component. Consequently, when the AST is later scanned for security threats, any dangerous import from the `builtins` module (such as __import__) is invisible to the analyzer. An attacker can craft a malicious pickle file that uses `builtins.__import__` to import modules like `os` and then call `os.system()` to execute arbitrary commands. Because the import node is absent from the AST, the data flow analysis incorrectly traces the payload as a series of seemingly benign variable assignments and object state updates, ultimately misclassifying the malicious pickle as LIKELY_SAFE. This creates a critical security bypass in the tool’s primary function.
Platform: Fickling
Version: Prior to fix
Vulnerability : Security Bypass
Severity: Critical
date: 2024-04-30
Prediction: Patched 2024-04-30
What Undercode Say:
python3 poc.py fickling raw_bypass.pkl cat raw_bypass.pkl | xxd
poc.py excerpt payload += GLOBAL + b"builtins\n__import__\n" payload += STRING + b"'os'\n" payload += TUPLE1 + REDUCE
How Exploit:
Crafted pickle uses `builtins.__import__(‘os’)` and `getattr` to call system(), hiding the import source from AST-based analysis.
Protection from this CVE
Update to Fickling commit `9f309ab` or later which emits import nodes for dangerous builtins functions.
Impact
Arbitrary Code Execution via malicious pickle files, bypassing security analysis.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
