T09 · Insecure Skill Coding Practices
Error
- Location
scripts/vector_search.py:110- Finding
Arbitrary Code Execution Through Unsafe Pickle Cache Deserialization
- Content
View full analysis
100: try: with open(cache_path, 'rb') as f: cached = pickle.load(f) if cached.get('count') == count: print(f" 📦 TF-IDF缓存命中: {name} ({count}条)") return cached['docs'], cached['metas'], cached['index'] except: pass ``` ### Technical Analysis The application loads TF-IDF cache files with `pickle.load()`. Python pickle is an executable serialization format: specially constructed pickle opcodes can invoke arbitrary functions during deserialization. The cache directory comes from the `TFIDF_CACHE` environment variable and otherwise defaults to the relative path `./tfidf_cache`. The application does not validate the cache file's ownership, permissions, provenance, or integrity before deserializing it. The check against the cached collection count occurs only after `pickle.load()` has completed. It therefore cannot prevent execution of a malicious pickle payload. The broad exception handler also suppresses evidence of failed or malicious deserialization attempts. ### Attack Path 1. An attacker obtains write access to the process working directory, the configured `TFIDF_CACHE` directory, or a shared directory selected through the environment. 2. The attacker creates or replaces one of the expected cache files, such as `memories.pkl`, `knowledge.pkl`, or `projects.pkl`. 3. The malicious file is made larger than 100 bytes so it passes the size condition. 4. A user or agent invokes the search functionality. 5. `load_collection()` opens the attacker-controlled file and passes it ...[truncated 1013 chars]- Remediation
View remediation