Listen to this Post
The vulnerability exploits the `numpy.f2py.crackfortran.myeval` function, which is used in NumPy for evaluating Python expressions from strings. In Python’s pickle module, the `__reduce__` method allows objects to define custom serialization behavior. When pickle deserializes an object, it calls `__reduce__` to obtain a callable and its arguments, which are then executed. Attackers craft a malicious pickle file by creating a class with a `__reduce__` method that returns `numpy.f2py.crackfortran.myeval` and a string containing arbitrary code, such as os.system('ls'). Picklescan, a library designed to scan pickle files for dangerous functions, fails to detect `myeval` as hazardous because it is not included in its detection list. This results in a false negative during security scans. When victims rely on Picklescan’s assessment and proceed to load the pickle file using pickle.load(), the deserialization process invokes `myeval` with the attacker’s code string, leading to remote code execution. This is particularly critical in machine learning ecosystems where pickle files are commonly used to save models, and tools like Picklescan are trusted for safety checks. The issue stems from Picklescan’s incomplete blacklist of eval-like functions, allowing stealthy code execution bypassing detection.
Platform: Picklescan
Version: All versions
Vulnerability: Remote code execution
Severity: Critical
date: Unknown
Prediction: Patch date unspecified
What Undercode Say:
Analytics
Bash command: picklescan –file malicious.pkl
Python code:
import pickle
class RCE:
def __reduce__(self):
from numpy.f2py.crackfortran import myeval
return (myeval, (“os.system(‘ls’)”,))
with open(‘malicious.pkl’, ‘wb’) as f:
pickle.dump(RCE(), f)
How Exploit:
Craft pickle with __reduce__ using myeval.
Protection from this CVE
Update Picklescan detection.
Impact:
RCE via pickle files.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
