N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4vr7-g93g-cf6m

GHSA-4vr7-g93g-cf6m: Duplicate Advisory: Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references.

Original Description

An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4vr7-g93g-cf6m

GHSA-4vr7-g93g-cf6m:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 0.0.31	0.0.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-mjqp-26hc-grxg, allows a bypass of the picklescan security scanner. The root cause is an unhandled exception when processing ZIP archives containing files with CRC errors. The scanner uses a custom RelaxedZipFile class to handle ZIP files. My analysis of the patch between the vulnerable version 0.0.30 and the patched version 0.0.31 pinpointed the exact location of the fix.

The commit 28a7b4ef753466572bda3313737116eeb9b4e5c5 modifies the open method within src/picklescan/relaxed_zipfile.py. Previously, the method would return a standard zipfile.ZipExtFile object. When reading from this object, the underlying zipfile library performs a CRC check. If the check fails, it raises an exception, which picklescan did not handle gracefully, leading to the termination of the scan for that archive.

The patch mitigates this by creating the ZipExtFile object and then immediately monkey-patching its _expected_crc attribute to None. This effectively disables the CRC validation, preventing the exception from being thrown and allowing the scanner to proceed with analyzing the file's contents, even if the CRC is invalid. This ensures that potentially malicious files within a corrupted ZIP archive are not skipped.

Therefore, the RelaxedZipFile.open function is the direct source of the vulnerability, as it was responsible for setting up the file stream in a way that was susceptible to interruption by CRC errors.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.