GHSA-f7qq-56ww-84cr

Описание

Summary

The vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from PickleScan's strict check for full module names against its list of unsafe globals. By using subclasses of dangerous imports instead of the exact module names, attackers can circumvent the check and inject malicious payloads.

PoC

1. Download a model that uses the asyncio package:

wget https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl

2. Check with PickleScan: picklescan -p asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl -g

Expected Result:

PickleScan should identify all asyncio import as dangerous and flag the pickle file as malicious as asyncio is in _unsafe_globals dictionary.

Actual Result:

PickleScan marked the import as Suspicious, failing to identify it as a dangerous import.

Impact

Severity: High Affected Users: Any organization, like HuggingFace, or individual using PickleScan to analyze PyTorch models or other files distributed as ZIP archives for malicious pickle content. Impact Details: Attackers can craft malicious PyTorch models containing embedded pickle payloads, package them into ZIP archives, and bypass the PickleScan check by using subclasses of dangerous imports. This could lead to arbitrary code execution on the user's system when these malicious files are processed or loaded.

Recommendations:

Replace: https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309C9-L309C54

unsafe_filter = _unsafe_globals.get(g.module)

by: