Listen to this Post
The vulnerability GHSA-5hvc-6wx8-mvv4 is a detection bypass in the Fickling security tool for Python pickle files. Fickling’s analysis failed to recognize imports of the `pydoc` and `ctypes` modules as unsafe. An attacker could construct a malicious pickle payload that uses `pydoc.locate()` to dynamically resolve and load a dangerous function like ctypes.windll.kernel32.WinExec. When this pickle is deserialized, it executes the resolved function, leading to Remote Code Execution (RCE). The exploit cleverly hides the result of the RCE call within an `Exception` object’s state using the `__setstate__` method. This obfuscation tricked Fickling’s unused variable analysis, causing the scanner to incorrectly report the malicious file as “LIKELY_SAFE.” The bypass was effective because these specific module imports were not on the tool’s blocklist, and other scanners like `picklescan` also missed the `pydoc.locate` gadget.
Platform: Python
Version: Fickling
Vulnerability: Detection Bypass RCE
Severity: High
date: 2026-01-10
Prediction: Patch available (2025-12-15)
What Undercode Say:
python3 generate_stealth_payload.py fickling --check stealth_ctypes.pkl
PoC Payload Generation (simplified)
payload = b''
payload += b'cpydoc\nlocate\n'
payload += b"S'ctypes.windll.kernel32.WinExec'\n"
payload += b'\x85R'
... builds full exploit pickle
with open("stealth_ctypes.pkl", "wb") as f:
f.write(payload)
How Exploit:
Chain Gadgets: Use `pydoc.locate(‘ctypes.windll.kernel32.WinExec’)` within pickle opcodes.
Execute: Call the returned function with arguments like (b'calc.exe', 1).
Evade Detection: Store the result inside an `Exception` object via `__setstate__` to bypass unused variable checks.
Protection from this CVE
Update Fickling to a version including commit `b793563`.
The fix adds `”ctypes”` and `”pydoc”` to the tool’s `unsafe_imports` blocklist.
Do not deserialize untrusted pickle files.
Impact:
Remote Code Execution: Successful exploitation allows arbitrary command execution on the target system.
Security Tool Failure: Undermines trust in pickle security scanners, posing a significant risk in environments like ML model sharing where pickle is common.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
