Listen to this Post
This vulnerability exploits a gap in Picklescan’s default dangerous function blocklist. Picklescan is a security tool designed to scan pickle files for malicious code by blocking specific Python functions like open() and shutil that could lead to arbitrary file writes. However, the distutils module is not included in this blocklist. An attacker can craft a pickle payload that uses distutils.file_util.write_file function, which is capable of writing content to any file on the system. When a vulnerable application unserializes such a malicious pickle file without proper validation, the distutils.file_util.write_file function is executed. This function takes a target file path and content as arguments, allowing the attacker to specify any file location and data. Consequently, critical system files such as .ssh/authorized_keys, web server configuration files, or application source code can be overwritten. This arbitrary file write can be leveraged to cause a Denial of Service (DoS) by corrupting essential files or to achieve Remote Code Execution (RCE) by planting malicious code. The vulnerability specifically impacts downstream users who rely on Picklescan to sanitize pickle inputs, as the tool fails to detect this bypass method. The issue stems from an incomplete blocklist that omits the distutils module, which contains file manipulation utilities similar to the blocked ones. Exploitation requires the attacker to convince a user or system to load the malicious pickle file, often through social engineering or compromised data sources. The PoC demonstrates creating a pickle file that, when loaded, writes a specified string to a target file named “pwned_config.env”. This simple proof of concept can be adapted to overwrite more sensitive files with harmful content. The fix involves updating Picklescan’s blocklist to include distutils and its dangerous functions, thereby preventing this bypass technique.
Platform: Picklescan
Version: Not specified
Vulnerability: Arbitrary file write
Severity: Critical
Date: Not specified
Prediction: Patch expected soon
What Undercode Say:
Analytics
python3 -c "import pickle, distutils.file_util; class Exploit: def <strong>reduce</strong>(self): return (distutils.file_util.write_file, ('pwned.env', ['malicious_content'])) ; payload=pickle.dumps(Exploit()); open('malicious.pkl','wb').write(payload)"
picklescan --directory /path/to/pickles
How Exploit:
Craft pickle payload using distutils.file_util.write_file to overwrite system files like /etc/passwd or .ssh/authorized_keys.
Protection from this CVE
Add distutils to Picklescan’s dangerous blocklist.
Impact:
Remote Code Execution, Denial of Service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
