4 ms·
That quote supports my statement. Notice that the serialized object is the thing that was constructed by the attacker, not some user data that you serialized yo
by ademarre 4y ago
That quote supports my statement. Notice that the serialized object is the thing that was constructed by the attacker, not some user data that you serialized yourself.
- cratermoon 4y agoNo the input was not serialized, it was carefully crafted so that when it gets serialized and deserialized, it triggers the malicious payload.
- ademarre 4y agoNo. That is not how it works. https://docs.python.org/3/library/pickle.html https://docs.python.org/3/library/pickle.html https://blog.nelhage.com/2011/03/exploiting-pickle/ https://blog.nelhage.com/2011/03/exploiting-pickle/ (referenced from https://cwe.mitre.org/data/definitions/502.html#REF-467 https://cwe.mitre.org/data/definitions/502.html#REF-467)