Picklescan Remote Code Execution Vulnerability via Undetected Malicious Pickle Files

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.30. The issue arises because the tool fails to detect harmful pickle files that call the PyTorch function torch.utils.bottleneck.__main__.run_autograd_prof. This oversight allows attackers to embed malicious code in pickle files, which is executed during deserialization, thereby enabling remote code execution.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the system deserializing the malicious pickle file.

Reproduction

To reproduce this vulnerability, create a pickle file that includes a payload invoking the PyTorch function torch.utils.bottleneck.__main__.run_autograd_prof. This can be done by defining a class that overrides the __reduce__ method to return the function and the code to be executed. Once the pickle file is created, use Picklescan to scan it. The tool will not flag the file as dangerous. Afterward, load the pickle file using Python's pickle.load() function, which will trigger the execution of the embedded code.

Remediation

Users should update to Picklescan version 0.0.30 or later, where this vulnerability has been addressed.