You can deploy this model and start earning money today!

xiaoyaoes/
clearml-pickle-rce

Name: clearml-pickle-rce
Availability: InStock

Views

No views yet

ClearML Pickle RCE PoC

Reported to huntr by xiaoyaoes

Vulnerability Location

File: clearml/binding/artifacts.py:309

The artifact loading mechanism calls pickle.load() to deserialize artifacts of type "pickle". The sole protection — SHA256 integrity check — only verifies that the file hasn't been corrupted, NOT that it's safe.

Key Details

block_unsafe_artifacts: bool = False (line 208) — default is OFF
SHA256 integrity check — only verifies file integrity, not safety
Zero pickle safety protections — no safe_globals, no trusted, no weights_only

Reproduction Steps

Create a malicious pickle payload with arbitrary code execution
Compute the SHA256 hash of the malicious pickle
Upload as a ClearML artifact with matching hash metadata
When any ClearML agent loads the artifact → pickle.load() triggers RCE

PoC

python

import pickle, os

class Pwn:
    def __reduce__(self):
        return (os.system, ('id',))

with open("clearml_poc.pkl", "rb") as f:
    pickle.load(f)  # ← RCE
    pickle.dump(Pwn(), f)

# When ClearML loads this pickle file → RCE triggered

Impact

CVSS 9.8 — Remote Code Execution

Default configuration is vulnerable
Supply chain attack vector
No authentication required to receive the attack

xiaoyaoes/clearml-pickle-rce