GHSA-j343-8v2j-ff7w: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand

The security vulnerability GHSA-j343-8v2j-ff7w exists in the picklescan library because it failed to identify idlelib.pyshell.ModifiedInterpreter.runcommand as a potentially dangerous function when scanning pickle files. The vulnerability is not a flaw in a function written by the picklescan authors, but rather a sin of omission in its threat detection logic.

The exploit PoC demonstrates that an attacker can create a class with a __reduce__ method that returns ModifiedInterpreter.runcommand and a command to be executed. When an application using a vulnerable version of picklescan scans this malicious pickle, it will be deemed safe. However, when this pickle is subsequently loaded (e.g., via pickle.load()), the runcommand function is executed, resulting in arbitrary code execution on the victim's machine.

The provided patch, commit 1931c2d04eaca8d20597705ff39cab78ba364e4b, rectifies this vulnerability. The core of the fix is in src/picklescan/scanner.py, where the dangerous_globals dictionary is updated to include "idlelib.pyshell": {"ModifiedInterpreter.runcode", "ModifiedInterpreter.runcommand"}. This ensures that any pickle file attempting to use this function will be correctly identified as dangerous.

Therefore, the function idlelib.pyshell.ModifiedInterpreter.runcommand is the one that would appear in a runtime profile or stack trace during the actual exploitation phase (i.e., when the malicious pickle is loaded), making it the key indicator of this vulnerability being triggered.