7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jgw4-cr84-mqxg

GHSA-jgw4-cr84-mqxg: Picklescan Bypass is Possible via File Extension Mismatch

Summary

Picklescan can be bypassed, allowing the detection of malicious pickle files to fail, when a standard pickle file is given a PyTorch-related file extension (e.g., .bin). This occurs because the scanner prioritizes PyTorch file extension checks and errors out when parsing a standard pickle file with such an extension instead of falling back to standard pickle analysis. This vulnerability allows attackers to disguise malicious pickle payloads within files that would otherwise be scanned for pickle-based threats.

Details

The vulnerability stems from the logic in the scan_bytes function within picklescan/scanner.py, specifically around line 463: https://github.com/mmaitre314/picklescan/blob/75e60f2c02f3f1a029362e6f334e1921392dcf60/src/picklescan/scanner.py#L463 The code first checks if the file extension (file_ext) is in the pytorch_file_extension list. If it is (e.g., .bin), the scan_pytorch function is called. When a standard pickle file is encountered with a PyTorch extension, scan_pytorch will likely fail. Critically, the code then returns an Error without attempting to analyze the file as a standard pickle using scan_pickle_bytes. This prevents the detection of malicious payloads within such files.

PoC

Download a malicious pickle file with a standard .pkl extension: wget https://huggingface.co/kzanki/regular_model/resolve/main/model.pkl?download=true -O model.pkl
Scan the file with Picklescan (correct detection): /home/davfr/Tests/HF/dangerous_model/model.pkl: dangerous import 'builtins exec' FOUND ----------- SCAN SUMMARY ----------- Scanned files: 1 Infected files: 1 Dangerous globals: 1
Rename the file to use a PyTorch-related extension (e.g., .bin): cp model.pkl model.bin
Scan the renamed file with Picklescan:

Picklescan fails and reports an error related to PyTorch parsing but does not detect the malicious pickle content. : Picklescan should recognize the file as a standard pickle format despite the .bin extension and scan it accordingly, identifying the malicious content.

Miggo Vulnerability Database

→

GHSA-jgw4-cr84-mqxg

GHSA-jgw4-cr84-mqxg:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	<= 0.0.30	0.0.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the file-type detection logic within the picklescan.scanner.scan_bytes function. This function is the primary entry point for scanning files and byte streams for malicious pickle data.

The flaw occurs when the scanner encounters a file with a file extension typically associated with PyTorch models (e.g., .bin). The scanner's logic gives precedence to the file extension, and it will first attempt to parse the file as a PyTorch model using the scan_pytorch function. If the file is actually a standard pickle file and not a PyTorch model, this parsing will fail, raising an InvalidMagicError.

In the vulnerable versions (<= 0.0.30), the scan_bytes function catches this exception but then immediately returns an error result, halting any further analysis of the file. It fails to implement a crucial fallback mechanism to check if the file might be a standard pickle file despite its misleading extension.

An attacker can exploit this by taking a malicious pickle file and renaming it with a .bin extension. When a user scans this file with the vulnerable version of picklescan, the tool will fail to detect the malicious payload because the scan_pickle_bytes function is never called for that file. This effectively creates a bypass of the scanner's security checks.

The patch rectifies this by removing the premature return. When scan_pytorch fails, the code now logs a warning and allows execution to continue. This enables the scanner to subsequently attempt other scanning methods, including scan_pickle_bytes, which will correctly identify the malicious content. Therefore, a runtime profile of an exploit would show a call to scanner.scan_bytes that, in the vulnerable version, exits without calling scanner.scan_pickle_bytes for the malicious file.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.8

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-jgw4-cr84-mqxg: Picklescan Bypass is Possible via File Extension Mismatch

Summary

Details

PoC

GHSA-jgw4-cr84-mqxg:

7.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

7.8

7.8

Technical Details

Basic Information

Basic Information

GHSA-jgw4-cr84-mqxg: Picklescan Bypass is Possible via File Extension Mismatch

Summary

Details

PoC

Impact

Suggested Patch

7.8

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-jgw4-cr84-mqxg: Picklescan Bypass is Possible via File Extension Mismatch

Summary

Details

PoC

GHSA-jgw4-cr84-mqxg:

7.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

7.8

7.8

Technical Details

Basic Information

Basic Information

GHSA-jgw4-cr84-mqxg: Picklescan Bypass is Possible via File Extension Mismatch

Summary

Details

PoC

Impact

Suggested Patch

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI