BREW-pocsuite3-GHSA-cq46-m9x9-j8w2 — Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization

Affected: Homebrew: pocsuite3

### Summary

An unsafe deserialization vulnerability in Scapy <v2.7.0 allows attackers to execute arbitrary code **when a malicious session file is locally loaded via the `-s` option**. This requires convincing a user to manually load a malicious session file.

---

### Details

Scapy’s interactive shell supports session loading using gzip-compressed pickle files:

```bash ./run_scapy -s <session_file.pkl.gz> ```

Internally, this triggers:

```python # main.py SESSION = pickle.load(gzip.open(session_name, "rb")) ```

Since no validation or restriction is performed on the deserialized object, **any code embedded via `__reduce__()` will be executed immediately**. This makes it trivial for an attacker to drop a malicious `.pkl.gz` in a shared folder and have it executed by unsuspecting users.

The vulnerability exists in the `load_session` function, which deserializes data using `pickle.load()` on `.pkl.gz` files provided via the `-s` CLI flag or programmatically through `conf.session`.

**Affected lines in source code**: https://github.com/secdev/scapy/blob/master/scapy/main.py#L569-L572

```python try: s = pickle.load(gzip.open(fname, "rb")) except IOError: try: s = pickle.load(open(fname, "rb")) ```

### Impact

This is a classic deserialization vulnerability which leads to Code Execution (CE) when untrusted data is deserialized.

Any user who can trick another user into loading a crafted `.pkl.gz` session file (e.g. via `-s` option) can execute arbitrary Py…

Most recent entries from all

BREW-pocsuite3-GHSA-cq46-m9x9-j8w2 — Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization