0X-Apollyon

Tornado is a Python web framework and asynchronous networking library. In versions prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` requests is the `max body size` setting, which defaults to 100MB. Because parsing of these requests occurs synchronously on the main thread, this can lead to a denial-of-service condition due to the computational cost of processing very large multipart bodies with numerous parts. Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request, configurable through `tornado.httputil.ParseMultipartConfig`. It is also possible to disable `multipart/form-data` parsing entirely if it is not required.

Fickling, a Python pickling decompiler and static analyzer, does not explicitly block the `ctypes` and `pydoc` modules in versions prior to 0.1.7. Combining these modules can lead to Remote Code Execution (RCE), even while the scanner reports the file as LIKELY SAFE. The issue arises because existing pickle scanning tools, such as `picklescan`, also do not block `pydoc.locate`.

Fickling, a Python pickling decompiler and static analyzer, is susceptible to a detection bypass due to a "builtins" blindness issue. This allows for potential circumvention of security measures.

An incomplete deny-list fails to block the `pydoc.locate()` and `operator.methodcaller()` functions. This allows remote attackers to bypass security checks by crafting malicious pickle files. The `pydoc.locate()` function can dynamically resolve and import arbitrary modules, while `operator.methodcaller()` enables the execution of a method on an object. When combined, these functions can be used to achieve arbitrary code execution during the deserialization of the pickle file.

An arbitrary file writing issue exists because the default dangerous blocklist fails to include the `distutils` module. While `open()` and `shutil` are blocked to prevent unauthorized file overwrites, attackers can bypass these restrictions by using the `distutils.file util.write file` function. By constructing malicious pickle objects, an attacker can overwrite critical system files, such as web server configurations, source code, or `.ssh/authorized keys`, leading to denial of service or remote code execution.

The software fails to block the `ctypes` module, which is a foreign function interface library used to call C functions directly, load DLLs, and manipulate raw memory pointers. This allows attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory, bypassing sandbox protections and gadget chain detection. For example, malicious pickle files can be crafted using `ctypes.WinDLL` to load `kernel32.dll` and execute arbitrary commands.