Picklescan Remote Code Execution Vulnerability via Undetected Malicious Pickle Files

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.30. The issue arises because the tool fails to detect harmful code embedded in pickle files, specifically when the 'idlelib.run.Executive.runcode' function is used in the 'reduce' method. This undetected code execution occurs during the unpickling process with 'pickle.load', allowing attackers to execute arbitrary code in PyTorch environments. Additionally, this vulnerability poses a supply chain risk, as infected pickle files could be distributed across machine learning models, APIs, or saved Python objects.

Impact

Exploitation of this vulnerability allows for remote code execution on the system where the pickle file is loaded. This could lead to unauthorized access, data manipulation, or other malicious activities, depending on the executed code. In the context of a supply chain attack, such exploitation could have widespread implications if the infected pickle file is used in a distributed manner across multiple systems or applications.

Reproduction

To reproduce this vulnerability, create a pickle file that includes a payload calling 'idlelib.run.Executive.runcode' in the 'reduce' method. This can be done by crafting a class that overrides the 'reduce' method to return a tuple containing the 'Executive.runcode' function and a payload, such as a command to be executed. Once the malicious pickle file is created, use Picklescan to scan it. Picklescan will not detect the embedded code as a threat. Afterward, load the pickle file using 'pickle.load', which will trigger the execution of the embedded code, demonstrating the vulnerability.

Remediation

Users can upgrade to Picklescan version 0.0.30 or later, where this vulnerability has been addressed.