Picklescan Remote Code Execution Vulnerability via Undetected Malicious Pickle Files

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.33. The issue arises because the tool fails to detect harmful code embedded in pickle files, particularly when the numpy function 'f2py.crackfortran.param_eval' is used in certain methods. This oversight allows attackers to insert undetected code that executes during the deserialization of the pickle file, leading to arbitrary code execution in applications that load untrusted pickle data.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the host machine, executed in the context of the user running the application that deserializes the malicious pickle file.

Reproduction

To reproduce this vulnerability, create a pickle file that includes a payload using the numpy function 'f2py.crackfortran.param_eval'. This payload should be designed to execute a command, such as listing directory contents, when the pickle file is loaded. Once the malicious pickle file is prepared, use Picklescan to scan it. The tool will not detect the embedded code, allowing the file to be loaded safely. When the pickle file is deserialized, the embedded code will execute, demonstrating the vulnerability.

Remediation

Users are advised to update Picklescan to version 0.0.33 or later, where this vulnerability has been patched.