Yash2998Chhabria

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 1.0.4 UniFi OS Server (affected versions not specified) **Description** picklescan fails to block `pkgutil.resolve name`, which allows attackers to bypass the blocklist by resolving dangerous functions through indirect REDUCE calls. This enables remote attackers to invoke blocked functions such as `os.system`, `builtins.exec`, or `subprocess.call` to achieve remote code execution. UniFi OS Server contains an improper access control flaw where nginx evaluates the raw request URI for authentication but routes using the normalized URI. This allows unauthenticated attackers to reach protected endpoints and chain the issue into full root remote code execution. **Recommendations** Update picklescan to version 1.0.4 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability regarding UniFi OS Server.

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 1.0.4 **Description** An incomplete blocklist for the `profile` module fails to block the module-level `profile.run()` function. This allows attackers to achieve arbitrary code execution via `exec()` by crafting malicious pickle files that call `profile.run(statement)`. The issue occurs because the scanner performs an exact string comparison and the blocklist entry `Profile.run` does not match the pickle global name `run`. Consequently, the scanner reports zero security issues while the payload executes arbitrary Python code. **Recommendations** Update to version 1.0.4 or later. As a temporary workaround, restrict the processing of untrusted pickle files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 1.0.4 **Description** The software fails to block at least seven Python standard library modules, including `uuid`, ` osx support`, ` aix support`, ` pyrepl.pager`, and `imaplib`. This oversight exposes eight functions that allow direct arbitrary command execution. Attackers can bypass safety validation by crafting malicious pickle files that import these unblocked modules to achieve remote code execution. **Recommendations** Update to version 1.0.4.