CVE-2025-67747
📋 TL;DR
Fickling versions before 0.1.6 fail to block unsafe 'marshal' and 'types' module imports during pickle file analysis. This allows attackers to craft malicious pickle files that bypass security checks, potentially leading to arbitrary code execution when users deserialize these files. This affects anyone using Fickling to vet pickle files for security issues.
💻 Affected Systems
- Fickling
📦 What is this software?
Fickling by Trailofbits
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the user running Fickling, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Local privilege escalation or arbitrary code execution when users analyze untrusted pickle files, potentially compromising the host system.
If Mitigated
No impact if proper patching is applied or if Fickling is not used to analyze untrusted pickle files.
🎯 Exploit Status
The vulnerability is well-documented in the advisory with clear exploitation vectors. Crafting malicious pickle files to exploit this is straightforward for attackers with Python knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.6
Vendor Advisory: https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3
Restart Required: No
Instructions:
1. Update Fickling to version 0.1.6 or later using pip: 'pip install --upgrade fickling>=0.1.6'. 2. Verify the update was successful by checking the version. 3. No restart is required as this is a Python library update.
🔧 Temporary Workarounds
Avoid analyzing untrusted pickle files
allTemporarily stop using Fickling to analyze pickle files from untrusted sources until patched.
Use virtual environment with older version
linuxIsolate vulnerable Fickling installations in virtual environments to limit potential damage.
python -m venv isolated_env
source isolated_env/bin/activate
pip install fickling<0.1.6
🧯 If You Can't Patch
- Implement strict input validation to reject pickle files from untrusted sources
- Run Fickling in a sandboxed environment with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check Fickling version: 'python -c "import fickling; print(fickling.__version__)"' - if version is less than 0.1.6, you are vulnerable.Check Version:
python -c "import fickling; print(fickling.__version__)"Verify Fix Applied:
After updating, verify version is 0.1.6 or higher using the same command. Test with known safe pickle files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution following pickle file analysis
- Errors or warnings related to marshal.loads or types.FunctionType in application logs
Network Indicators:
- Unusual outbound connections from systems running Fickling
- Data exfiltration patterns following pickle file processing
SIEM Query:
process_name:"python" AND (command_line:"fickling" OR command_line:"pickle") AND (event_type:"process_execution" OR event_type:"network_connection")