9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4mpj-78p6-rj59

GHSA-4mpj-78p6-rj59: Duplicate Advisory: PickleScan's profile.run blocklist mismatch allows exec() bypass

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7wx9-6375-f5wh. This link is maintained to preserve external references.

Original Description

picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4mpj-78p6-rj59

GHSA-4mpj-78p6-rj59:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 1.0.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-7wx9-6375-f5wh, exists in the picklescan library's scanning logic due to an incomplete blocklist. The core issue is that the scanner failed to recognize the module-level profile.run() function as dangerous, while it did block the class method profile.Profile.run().

The analysis of the patch in commit bf26452ae2e3204429762c2bb1aa9eacd40436bb reveals the fix. In src/picklescan/scanner.py, the UNSAFE_GLOBALS dictionary, which serves as the blocklist, was updated. The entry for the "profile" module was changed from {"Profile.run", "Profile.runctx"} to "*". This change ensures that any function from the profile module is now considered dangerous, effectively closing the bypass that allowed the use of profile.run().

The functions that utilize this UNSAFE_GLOBALS blocklist are the ones considered vulnerable. The advisory's proof-of-concept explicitly calls picklescan.scanner.scan_pickle_bytes to demonstrate the vulnerability. This function processes pickle data and, due to the incomplete blocklist, would incorrectly report a malicious pickle as safe. Another function, scan_file_path, is also present and tested in the same file, and it's highly probable that it uses the same flawed scanning logic.

Therefore, during exploitation (i.e., scanning a malicious pickle), a runtime profiler would show scanner.scan_pickle_bytes or scanner.scan_file_path executing and failing to detect the threat. The subsequent loading of this 'cleared' pickle by an application would lead to the execution of profile.run, resulting in arbitrary code execution.

Vulnerable functions

scanner.scan_pickle_bytes

src/picklescan/scanner.py

This function is responsible for scanning pickle data for dangerous content. It uses a blocklist (UNSAFE_GLOBALS) to identify and flag malicious functions. The vulnerability lies in the fact that this function uses an incomplete blocklist for the 'profile' module. The blocklist only contained 'Profile.run' and 'Profile.runctx', failing to block the module-level 'profile.run' function. An attacker can craft a pickle that calls 'profile.run' to execute arbitrary code, and this scanning function would incorrectly determine it as safe.

scanner.scan_file_path

src/picklescan/scanner.py

Similar to scan_pickle_bytes, this function is responsible for scanning pickle files. It likely uses the same underlying scanning logic and the same flawed blocklist (UNSAFE_GLOBALS). Therefore, it would also fail to detect a malicious pickle using 'profile.run' for arbitrary code execution. The test suite modifications in 'test_scanner.py' exercise this function, indicating it's a user-facing scanning function affected by the blocklist change.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.