The First Large-Scale Systematic Study of Python Class Pollution Vulnerability

Class pollution is a recently discovered, yet underexplored Python vulnerability that allows attackers to pollute unintended runtime objects by exploiting the class-based inheritance model and reflection mechanism. Before this paper, only two real-world vulnerabilities related to class pollutionincluding one reported to the Common Vulnerabilities and Exposures (CVE) database-were discovered. Furthermore, there was no existing tool capable of detecting such vulnerabilities, let alone a systematic study of vulnerable code patterns, exploitation techniques, and real-world prevalence.

In this paper, we design and implement Pyrl, the first framework for detecting class pollution vulnerabilities in realworld applications via a novel, static operational taint analysis.

Our key insight is that class pollution consists of two types of vulnerable code primitives-"get" and "set"-for fetching and setting items and attributes. Different combinations of these primitives (two types of "get"s and three "set"s) further lead to six unique vulnerability types according to our first taxonomy of class pollution. Pyrl's operational taint analysis tracks attacker-controlled inputs on these primitives and their combinations using fine-grained, operational taint labels that are initiated, transformed, propagated, and merged according to the analysis context.

We applied Pyrl to over half a million real-world Python programs from GitHub and PyPI, resulting in the detection of 47 zero-day, exploitable class pollutions. Our findings include critical vulnerabilities in widely used applications, such as Azure CLI by Microsoft and Mesop by Google, both of which have been acknowledged and patched. We have responsibly reported all identified vulnerabilities to the corresponding developers-who fixed five of them-and CVE Numbering Authorities (CNAs)-who assigned seven CVE identifiers.