T09 · Insecure Skill Coding Practices
Error
- Location
- context_cache_manager.py:129
- Finding
- Arbitrary Code Execution Through Unsafe Pickle Deserialization<![CDATA[ ## Vulnerability Details **File Location**: `context_cache_manager.py:129-136` **Vulnerability Type**: Unsafe deserialization **Risk Level**: Critical ### Vulnerable Code ```python def load_snapshot(session_id: str) -> Optional[ContextSnapshot]: """从磁盘加载快照""" cache_path = get_cache_path(session_id) # 查找可能的文件 for file_path in CACHE_DIR.glob(f"{session_id}-*.pkl.gz"): try: with gzip.open(file_path, 'rb') as f: data = pickle.load(f) return ContextSnapshot(**data) except Exception: continue return None ``` ### Technical Analysis The application deserializes cache files with `pickle.load()`. Python pickle is an executable serialization format: a crafted object can define reduction operations that invoke arbitrary functions during deserialization. The cache file is not authenticated or otherwise verified before it is loaded. Catching exceptions does not mitigate this issue because malicious reduction operations execute during `pickle.load()` before the function returns or raises a subsequent validation error. An attacker who can create or replace a matching `.pkl.gz` file in the cache directory can therefore execute arbitrary Python code when the affected session is restored or forked. ### Attack Path 1. The attacker obtains write access to `~/.openclaw/workspace/tmp/context-cache`, or exploits another path-handling or local file-write weakness. 2. The attacker generates a malicious pickle payload whose reduction method executes a command or Python callable. 3. The payload is gzip-compressed and saved using a name matching `<session_id>-*.pkl.gz`. 4. The victim invokes `restore()` or `fork_context()` for the matching session. 5. `load_snapshot()` opens the attacker's file and passes its contents to `pickle.load()`. 6. The embedded reduction operation executes with the privileges of the Agent process. ### Impact Assessment Successful exploitation ...[truncated 466 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace pickle with a non-executable serialization format such as JSON. 2. Validate the complete decoded schema before constructing `ContextSnapshot`, including: - Required and permitted field names - Exact field types - Maximum string and collection sizes - Permitted `state` values - Message object structure 3. Reject unknown fields and malformed snapshots rather than silently continuing. 4. Authenticate snapshots with a keyed MAC if local cache tampering is within the threat model. 5. If legacy pickle migration is required, perform it once in a tightly isolated, low-privilege process. Do not load unauthenticated legacy pickle files in the main Agent process. 6. Add tests proving that malformed or attacker-controlled serialized data cannot invoke code or construct unexpected object types. ]]>