SHUBH4M/modelscan-marshal-types-bypass

ModelScan False Negative: marshal/types Pickle Globals Bypass

ModelScan reports 0 issues; pickle.load() executes arbitrary code.

Root Cause

ModelScan's unsafe_globals blocklist in settings.py includes os, builtins, subprocess, sys, etc., but not marshal or types. A pickle referencing only marshal.loads and types.FunctionType passes with zero issues, yet achieves ACE:

marshal.loads(bytecode)          → code object
types.FunctionType(code_obj, {}) → function
function()                        → arbitrary code execution

Artifacts

File	Description
SUBMISSION.md	Full advisory
poc/poc_marshal_bypass.py	Standalone PoC
poc/exploit_marshal.pkl	Exploit pickle (227 B)
variants/build_variants.py	Build script for all 4 variants
variants/verify_modelscan.py	Verification script
variants/variant_*.pkl	4 variant exploit pickles

Quick Test

modelscan scan -p variants/variant_marshal_functiontype.pkl -r json
# → total_issues: 0

python3 -c "import pickle; pickle.load(open('variants/variant_marshal_functiontype.pkl','rb'))"
# → uid=...(sk) gid=...(sk) ... PICKLE_ACE

Variants

Variant	GLOBAL opcodes	Size
variant_marshal_functiontype.pkl	marshal loads, types FunctionType	227 B
variant_codetype_functiontype.pkl	types CodeType, types FunctionType	206 B
variant_marshal_lambdatype.pkl	marshal loads, types LambdaType	225 B
variant_stack_global.pkl	STACK_GLOBAL (protocol 4+)	233 B