marshal/types Pickle Globals Bypasspickle.load() executes arbitrary code.unsafe_globals blocklist in settings.py includes os, builtins, subprocess, sys, etc., but not marshal or types. A pickle referencing only marshal.loads and types.FunctionType passes with zero issues, yet achieves ACE:marshal.loads(bytecode) → code object
types.FunctionType(code_obj, {}) → function
function() → arbitrary code execution| File | Description |
|---|---|
SUBMISSION.md | Full advisory |
poc/poc_marshal_bypass.py | Standalone PoC |
poc/exploit_marshal.pkl | Exploit pickle (227 B) |
variants/build_variants.py | Build script for all 4 variants |
variants/verify_modelscan.py | Verification script |
variants/variant_*.pkl | 4 variant exploit pickles |
1modelscan scan -p variants/variant_marshal_functiontype.pkl -r json
2# → total_issues: 0
3
4python3 -c "import pickle; pickle.load(open('variants/variant_marshal_functiontype.pkl','rb'))"
5# → uid=...(sk) gid=...(sk) ... PICKLE_ACE| Variant | GLOBAL opcodes | Size |
|---|---|---|
variant_marshal_functiontype.pkl | marshal loads, types FunctionType | 227 B |
variant_codetype_functiontype.pkl | types CodeType, types FunctionType | 206 B |
variant_marshal_lambdatype.pkl | marshal loads, types LambdaType | 225 B |
variant_stack_global.pkl | STACK_GLOBAL (protocol 4+) | 233 B |