Picklescan Remote Code Execution Vulnerability via PyTorch GuardBuilder Function

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.28. The issue arises because the tool fails to detect malicious pickle files that exploit the PyTorch function 'torch._dynamo.guards.GuardBuilder.get' within 'reduce' methods. Attackers can craft these pickle files to include embedded code that evades Picklescan's detection, executing arbitrary commands when the files are loaded.

Impact

Exploitation of this vulnerability allows for remote code execution on the system loading the malicious pickle file, bypassing Picklescan's safety checks. This could lead to unauthorized command execution under the current user's privileges.

Reproduction

To reproduce this vulnerability, first create a pickle file that includes a payload exploiting the 'torch._dynamo.guards.GuardBuilder.get' function. This can be done by defining a class that overrides the 'reduce' method to return a tuple containing the 'GuardBuilder.get' function and the name of a command to execute, such as 'whoami'. Once the pickle file is crafted, use Picklescan to scan it. The scan will not detect the embedded malicious code. Afterward, load the pickle file using Python's 'pickle.load()' function, which will trigger the execution of the embedded command, demonstrating the vulnerability.

Remediation

Users can upgrade to Picklescan version 0.0.28 or later, where this vulnerability has been addressed.