drogba771/modelscan-pickle-bypass-poc

ModelScan 0.8.8 Bypass — Pickle Deserialization RCE

Target: huntr.com (Protect AI Model Upload Program)

Reward Tier: $750 (Unsafe Deserialization — Scanner Bypass)

CWE: CWE-502 (Deserialization of Untrusted Data)

---

Executive Summary

ModelScan 0.8.8 is Protect AI's scanner for detecting unsafe operations in ML model files. It flags pickle files containing dangerous GLOBAL imports (e.g., os.system, subprocess.Popen) by analyzing pickle opcodes via pickletools.genops().

This report demonstrates a complete bypass of ModelScan 0.8.8's pickle scanner. The technique achieves arbitrary code execution via pickle.load() while producing zero ModelScan issues.

Status: ✅ ModelScan bypass confirmed | ✅ RCE confirmed

---

The Vulnerability

Python's pickle module is inherently unsafe — pickle.load() can execute arbitrary code by design. ModelScan attempts to detect this by scanning pickle opcodes for "unsafe" module imports.

Blocklist (from modelscan/settings.py)

Severity	Blocked Modules/Functions
CRITICAL	__builtin__.{eval,compile,getattr,apply,exec,open,breakpoint,__import__}, builtins.{eval,...}, os*, nt*, posix*, subprocess*, sys*, socket*, pty*, pickle*, _pickle*, shutil*, asyncio*, runpy*, bdb*, pdb*, operator.attrgetter
HIGH	webbrowser*, httplib*, requests.api*, aiohttp.client*

Critical Gap: Modules NOT in the Blocklist

The following stdlib modules can be used for code execution but are completely absent from ModelScan's blocklist:

• ✅ marshal — marshal.loads() deserializes Python code objects
• ✅ types — types.FunctionType() creates executable functions from code objects
• ✅ ctypes — ctypes.CDLL(None).system() calls libc directly
• ✅ importlib — importlib.import_module('os') loads any module at runtime

---

Golden PoC: selfcontained_bypass_277.pkl

Metric	Value
Size	277 bytes
SHA256	9bc06071f234c0ddfe96ca9b43ecd873516492cbf99ae2ab835fbbbf2a6a2f80
pickle.load() RCE	✅ Confirmed
ModelScan 0.8.8	✅ 0 issues (0 critical, 0 high, 0 medium, 0 low)
Dependencies	None — fully self-contained

Verification

# RCE test (no dependencies)
python3.11 -c "import pickle; pickle.load(open('selfcontained_bypass_277.pkl','rb'))"
cat /tmp/huntr_bypass_poc  # → BYPASS_OK

# ModelScan bypass verification
modelscan scan -p selfcontained_bypass_277.pkl -r json
# → "total_issues": 0, "issues": []

Tested environment: CPython 3.11.15 + ModelScan 0.8.8 Note: marshal-based code objects are CPython minor-version specific; regenerate using build_selfcontained_pickle.py for the target Python minor version.

Technical Breakdown

The pickle uses only 2 GLOBAL imports, neither blocked:

Opcode	Import	In ModelScan blocklist?
GLOBAL types FunctionType	types.FunctionType	❌ NOT BLOCKED
GLOBAL marshal loads	marshal.loads	❌ NOT BLOCKED

Execution chain:

pickle.load()
  → marshal.loads(embedded_code_bytes)   # NOT scanned
  → types.FunctionType(code_obj, {})     # NOT scanned  
  → function() → import os → os.system() # Runtime, invisible to scanner

The embedded code object (232 bytes) contains a compiled function that imports os and calls os.system() at runtime — ModelScan never sees these opcodes because they don't exist in the pickle stream.

Alternative Bypass Variants

All confirmed 0 issues on ModelScan 0.8.8:

Variant	Size	Technique
marshal+types	291 B	marshal.loads → types.FunctionType
ctypes	115 B	ctypes.CDLL(None).system()
importlib	118 B	importlib.import_module('os')
class_traversal	124 B	().__class__.__bases__[0].__subclasses__() → os.system

---

Reproduction

Requirements

• Python 3.8+
• modelscan>=0.8.0 (optional, for verification)
• No additional dependencies

Step 1: Verify RCE

python3.11 -c "import pickle; pickle.load(open('selfcontained_bypass_277.pkl','rb'))"
cat /tmp/huntr_bypass_poc  # → BYPASS_OK

Step 2: Verify ModelScan bypass

modelscan scan -p selfcontained_bypass_277.pkl -r json
# Expected: "total_issues": 0

Step 3: Reproduce from scratch

python3.11 build_selfcontained_pickle.py
# Builds the 277-byte payload from source code (CPython version-specific)

---

Deliverable Files

File	Size	Description
selfcontained_bypass_277.pkl	277 B	⭐ Golden PoC — self-contained pickle, 0 deps, ModelScan bypass
build_selfcontained_pickle.py	7.5 KB	Builder script (reproduces golden PoC)
README.md	This file
pickles/pickle_bypass_marshal.pkl	291 B	marshal+types variant
pickles/pickle_bypass_ctypes.pkl	115 B	ctypes variant
pickles/pickle_bypass_importlib.pkl	118 B	importlib variant
pickles/pickle_bypass_class_traversal.pkl	124 B	class_traversal variant

Impact

• Any application using pickle.load(), joblib.load(), or torch.load() on untrusted files is vulnerable
• ModelScan 0.8.8 provides zero protection against this attack
• The technique works against ALL pickle-compatible scanners that only check GLOBAL opcodes
• Alternate bypasses: ctypes, importlib, builtins (partially)

Mitigation

• Do NOT rely on static pickle analysis for security — pickle is inherently unsafe
• Use alternative formats: .safetensors, ONNX, or signed pickles
• Run model loading in isolated sandboxes (containers, seccomp, AppArmor)
• Add marshal, types, ctypes, importlib to ModelScan's blocklist
• Implement behavioral analysis or dynamic taint tracking