Detection Bypass Vulnerability in Fickling: Exploiting Unsafe Imports
Summary
GHSA-83pf-v6qq-pwmr: Fickling has a detection bypass via stdlib network-protocol constructors. Affects fickling versions < 0.1.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fickling is a Python library designed for analyzing the safety of pickle files, particularly in machine learning contexts. It aims to identify potentially dangerous deserialization operations that could lead to arbitrary code execution. The library utilizes various heuristics to assess the safety of pickle files, but it has been found to have vulnerabilities that allow certain unsafe operations to bypass its checks.
Vulnerability Detail
The vulnerability in Fickling arises from a detection bypass that occurs when using standard library network-protocol constructors during the deserialization of pickle files. Specifically, the check_safety() API and --check-safety CLI flag incorrectly classify pickle files that open outbound TCP connections as 'LIKELY_SAFE'. This issue is rooted in two main causes: an incomplete blocklist of unsafe imports and a logic flaw in the unused_assignments() function. The incomplete blocklist fails to include several standard library modules that can initiate TCP connections, while the logic flaw allows certain variables to be misclassified as unused, preventing the detection of unsafe operations. This vulnerability can lead to serious consequences, including unauthorized data exfiltration and the establishment of covert channels.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using Fickling to analyze pickle files that utilize the standard library network-protocol constructors until the patch is applied. You can also manually inspect pickle files for unsafe operations before deserialization.
Conclusion
The detection bypass vulnerability in Fickling poses significant risks by allowing unsafe pickle files to be misclassified as safe. It is crucial for users of the library to update to the latest version to mitigate these risks and to remain vigilant in monitoring for potential exploits.
See every vulnerability recorded for fickling →
FAQ
The vulnerability allows certain unsafe pickle files to be incorrectly classified as 'LIKELY_SAFE', enabling potential exploitation through outbound TCP connections.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker could exploit this vulnerability to enumerate victims, exfiltrate host identities, probe internal services, and establish covert channels.
Yes, a patch has been implemented in PR #233, which addresses the incomplete blocklist issue. Ensure to update to the latest version of Fickling.
If an immediate update is not possible, refrain from using Fickling for analyzing pickle files that may utilize unsafe imports until the vulnerability is resolved.
References
Related vulnerabilities
Recent vulnerabilities recorded for fickling.
