picklescan - Arbitrary File Writing via distutils Module Bypass

An attacker crafts a malicious pickle file whose `__reduce__` method returns `distutils.file_util.write_file` along with a target file path and content. When picklescan scans this pickle, the dangerous blocklist does not flag `distutils`, allowing the file write operation to execute. This can overwrite critical system files such as `.ssh/authorized_keys` or web server configurations, leading to denial of service or remote code execution [ref_id=1].

The vulnerability lies in picklescan's dangerous blocklist, which includes `open()` and `shutil` but fails to block the `distutils` module. An attacker can use `distutils.file_util.write_file` to write arbitrary files, bypassing the existing protections [ref_id=1].

The advisory recommends adding `distutils` to the dangerous blocklist. Without a published patch, the fix would ensure that `distutils.file_util.write_file` is treated as a dangerous function and blocked during pickle scanning, preventing arbitrary file writes [ref_id=1].