CRITICAL: Unsafe Pickle Deserialization in Memory Bank

F007_Pickle_Deserialization.md

Finding F007: Unsafe Pickle Deserialization in Memory Bank

Severity: CRITICAL

Location

python/packages/autogen-ext/src/autogen_ext/experimental/task_centric_memory/_memory_bank.py (line 82) python/packages/autogen-ext/src/autogen_ext/experimental/task_centric_memory/_string_similarity_map.py (line 48)

Description

The MemoryBank and StringSimilarityMap classes use Python's pickle module for serialization/deserialization:

# _memory_bank.py line 82
with open(self.path_to_dict, "rb") as f:
    self.uid_memo_dict = pickle.load(f)  # VULNERABLE

# _string_similarity_map.py line 48
with open(path, "rb") as f:
    self.uid_text_dict = pickle.load(f)  # VULNERABLE

Pickle deserialization can execute arbitrary Python code when a malicious pickle file is loaded.

Attack Scenario

1. Attacker controls the pickle file (via path traversal, shared filesystem, etc.)
2. Pickle file contains malicious serialized object
3. When loaded, arbitrary code executes

Risk Assessment

• Severity: CRITICAL
• Impact: Arbitrary code execution
• Likelihood: MEDIUM (requires file system access)

Existing Mitigations

1. None identified

Recommendations

1. Replace pickle with JSON or another safe serialization format
2. If pickle is required, use RestrictedUnpickler pattern
3. Add file integrity verification (HMAC signature)
4. Document the risk and warn users not to use untrusted paths