GHSA-q5qq-mvfm-j35x

Описание

#Fickling's assessment

ctypes, importlib, runpy, code and multiprocessing were added the list of unsafe imports (https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66, https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9, https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91, https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1, https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1).

Original report

Summary

The unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks.

Details

In fickling/fickle.py lines 866-884, the unsafe_imports() method checks imported modules against a hardcoded tuple:

This list is incomplete. The following dangerous modules are NOT detected:

• ctypes: Allows arbitrary memory access, calling C functions, and bypassing Python restrictions entirely
• importlib: Can dynamically import any module at runtime
• runpy: Can execute Python modules as scripts
• code: Can compile and execute arbitrary Python code
• multiprocessing: Can spawn processes with arbitrary code

Since ctypes is part of the Python standard library, it also bypasses the NonStandardImports analysis.

PoC

Impact

Security Bypass (Confidentiality, Integrity, Availability)

An attacker can craft a malicious pickle that:

1. Imports ctypes to gain arbitrary memory access
2. Uses ctypes.pythonapi or ctypes.CDLL to execute arbitrary code
3. Passes Fickling's safety analysis as "likely safe"
4. Executes malicious code when the victim loads the pickle after trusting Fickling's verdict

This undermines the core purpose of Fickling as a pickle safety scanner.