Picklescan Remote Code Execution Vulnerability via Undetected Torch.fx Function Calls

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.28. The issue arises because the tool fails to detect calls to the PyTorch function 'torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression' within pickle files. This oversight allows attackers to embed malicious code that executes when the pickle file is loaded by the victim.

Impact

Exploitation of this vulnerability allows for arbitrary remote code execution on the victim's machine.

Reproduction

To reproduce this vulnerability, first create a pickle file that includes a call to 'torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression'. This can be done by crafting a payload that uses this function to execute remote code, such as a command to display the current user. Once the pickle file is prepared, it can be loaded using the Picklescan library, which will not detect the embedded malicious code. When the file is subsequently opened with 'pickle.load()', the remote code execution occurs.

Remediation

Users should update to Picklescan version 0.0.28 or later, where this vulnerability has been patched.