GHSA-p523-jq9w-64x9: Fickling Blocklist Bypass: cProfile.run()
Fickling's assessment`cProfile` was added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43).Original reportDescriptionSummaryFickling versions up to and including 0.1.6 do not treat Python's `cProfile` module as unsafe. Because of this, a malicious pickle that uses `cProfile.run()` is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS.If a user relies on Fickling's output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system.This affects any workflow or product that uses Fickling as a security gate for pickle deserialization.DetailsThe `cProfile` module is missing from fickling's block list of unsafe module imports in `fickling/analysis.py`. This is the same root cause as CVE-2025-67748 (pty) and CVE-2025-67747 (marshal/types).Incriminated source code:File: `fickling/analysis.py`Class: `UnsafeImports`Issue: The blocklist does not include `cProfile`, `cProfile.run`, or `cProfile.runctx`Reference to similar fix:PR #187 added `pty` to the blocklist to fix CVE-2025-67748PR #108 documented the blocklist approachThe same fix pattern should be applied for `cProfile`How the bypass works:Attacker creates a pickle using `cProfile.run()` in `__reduce__``cProfile.run()` accepts a Python code string and executes it directly (C-accelerated version of profile.run)Fickling's `UnsafeImports` analysis does not flag `cProfile` as dangerousOnly the `UnusedVariables` heuristic triggers, resulting in SUSPICIOUS severityThe pickle should be rated OVERTLY_MALICIOUS like `os.system`, `eval`, and `exec`Tested behavior (fickling 0.1.6):| Function | Fickling Severity | RCE Capable |
|----------|-------------------|-------------|
| os.system | LIKELY_OVERTLY_MALICIOUS | Yes |
| eval | OVERTLY_MALICIOUS | Yes |
| exec | OVERTLY_MALICIOUS | Yes |
| cProfile.run | SUSPICIOUS | Yes ← BYPASS |
| cProfile.runctx | SUSPICIOUS | Yes ← BYPASS |Suggested fix:Add to the unsafe imports blocklist in `fickling/analysis.py`:`cProfile``cProfile.run``cProfile.runctx``_lsprof` (underlying C module)PoCComplete instructions, including specific configuration details, to reproduce the vulnerability.Environment:Python 3.13.2fickling 0.1.6 (latest version, installed via pip)Step 1: Create malicious pickleStep 2: Analyze with ficklingExpected output (if properly detected):Actual output (bypass confirmed):Step 3: Prove RCE by loading the pickleOutputCheck: The code executes, proving RCE.Pickle disassembly (evidence):ImpactVulnerability Type:Incomplete blocklist leading to safety check bypass (CWE-184) and arbitrary code execution via insecure deserialization (CWE-502).Who is impacted:Any user or system that relies on fickling to vet pickle files for security issues before loading them. This includes:ML model validation pipelinesModel hosting platforms (Hugging Face, MLflow, etc.)Security scanning tools that use ficklingCI/CD pipelines that validate pickle artifactsAttack scenario:An attacker uploads a malicious ML model or pickle file to a model repository. The victim's pipeline uses fickling to scan uploads. Fickling rates the file as "SUSPICIOUS" (not "OVERTLY_MALICIOUS"), so the file is not rejected. When the victim loads the model, arbitrary code executes on their system.Why cProfile.run() is dangerous:Unlike `runpy.run_path()` which requires a file on disk, `cProfile.run()` takes a code string directly. This means the entire attack is self-contained in the pickle - no external files needed. Python docs explicitly state that `cProfile.run()` takes "a single argument that can be passed to the exec() function".`cProfile` is the C-accelerated version and is more commonly available than `profile`. It's also the recommended profiler per Python docs ("cProfile is recommended for most users"), so it's present in virtually all Python installations.Severity: HIGHThe attacker achieves arbitrary code executionThe security control (fickling) is specifically designed to prevent thisThe bypass requires no special conditions beyond crafting the pickle with cProfileAttack is fully self-contained (no external files needed)cProfile is more commonly used than profile, increasing attack surface
CVSS v4.0: 8.9