CVE-2022-31265 Mitigation

[SakuraIsayeki]

Could a mitigation or detection system be implemented in the replays unpacker, for CVE-2022-31265 ?

This vulnerability is currently affecting the WOWS Community, which has no way of mitigating against it from the game client. However could we get some detection for the replays_unpack library?

@imkindaprogrammermyself already developed a detection solution, available here: https://github.com/imkindaprogrammermyself/pickle-cndm.

If you need to discuss this further, do feel free to contact either of us. Here's my Discord: Sakura#9999

[Monstrofil]

Well, I knew about that vulnerability for a couple of years and never saw anyone who tried to use it in the wild. I don't think that we need detection in this library, maybe restricting some globals <https://docs.python.org/3/library/pickle.html#restricting-globals> like exec/eval and wrapping imports will be enough. Or maybe WG just finally removes all pickles from client-server protocol (anyone searched for the same vulnerability in server-side methods/props btw? :)) вс, 29 мая 2022 г. в 14:22, Sakura Isayeki ***@***.***>:

…

Could a mitigation or detection system be implemented in the replays unpacker, for CVE-2022-31265 <https://www.cve.org/CVERecord?id=CVE-2022-31265> ? This vulnerability is currently affecting the WOWS Community, which has no way of mitigating against it from the game client. However could we get some detection for the replays_unpack library? @imkindaprogrammermyself <https://github.com/imkindaprogrammermyself> already developed a detection solution, available here: https://github.com/imkindaprogrammermyself/pickle-cndm. If you need to discuss this further, do feel free to contact either of us. Here's my Discord: Sakura#9999 — Reply to this email directly, view it on GitHub <#22>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACCGX6EQVZT34UZEU7BTGUTVMNHQXANCNFSM5XIAUWBQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- С уважением, Александр.

[imkindaprogrammermyself]

Yes. A custom unpickler with whitelist would suffice but it wont catch everything unless you check every pickle in the replay file which is what I have done in this repo.

[Monstrofil]

it wont catch everything unless you check every pickle

not a problem actually, just need some safe_pickle.py used in all places in library and some BIG WARNING for anyone who will use this library saying not to use pickle directly in their scripts

[Monstrofil]

@SakuraIsayeki @imkindaprogrammermyself don't you have a code which creates and injects pickle with RCE into replays by any chance? I believe that WG did not fix this CVE properly and want to check that.

[SakuraIsayeki]

@SakuraIsayeki @imkindaprogrammermyself don't you have a code which creates and injects pickle with RCE into replays by any chance? I believe that WG did not fix this CVE properly and want to check that.

We do, as a matter of fact. Contact us on Discord, and we'll send you what we've got.
Here's my Discord: Sakura#9999

[imkindaprogrammermyself]

Hmm... that's concerning.