Listen to this Post
The vulnerability exploits the `picklescan` security scanner’s failure to detect the dangerous `_operator.methodcaller` function within malicious pickle payloads. Attackers craft a pickle payload that uses the `__reduce__` method to return _operator.methodcaller. This function is then called with arguments like `os.system` and a malicious command string. When `picklescan` analyzes the file, it does not flag `_operator.methodcaller` as a dangerous built-in, allowing the payload to pass as safe. Subsequently, when the victim uses `pickle.load()` on the scanned file, the `__reduce__` method executes, calling _operator.methodcaller('system', 'malicious_command'), which invokes `os.system()` and leads to arbitrary remote code execution on the victim’s system.
Platform: Python picklescan
Version: Prior to 0.0.16
Vulnerability: Detection Bypass RCE
Severity: Critical
Date: 2023-12-12
Prediction: Patched 2023-12-19
What Undercode Say:
pip install picklescan==0.0.15
import pickle import pickletools opcode = b'''cbuiltins <strong>import</strong> (Vos tRp0 0c_operator methodcaller (Vsystem Vecho "pwned" tR(g0 tR.''' pickletools.dis(opcode) pickle.loads(opcode)
How Exploit:
Craft malicious pickle.
Embed in model.
Distribute.
Protection from this CVE
Update picklescan.
Disable pickle loading.
Use safe serialization.
Impact:
Remote Code Execution.
ML Supply Chain Compromise.
Scanner Trust Broken.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
