joekaw/j0x-critical-poc

Vulnerability Disclosure: Critical RCE in Joblib

Vulnerability

Arbitrary Code Execution (ACE) via Pickle Deserialization.

Target Format

.joblib

Description

The target application uses joblib.load() on untrusted files, which utilizes Python's pickle module. By crafting a malicious pickle payload, an attacker can trigger arbitrary command execution upon loading the model.

Proof of Concept

The included poc.joblib file triggers an execution of echo ACE_TRIGGERED when loaded.

Steps to Reproduce

1. Load the model:

import joblib
joblib.load("poc.joblib")

2. Observe the command execution.

Recommendation

Transition away from pickle-based serialization (e.g., joblib, pickle) to safer formats like safetensors or json.