xiaoyaoes/modelscan-ext2-extension-bypass

ModelScan EXT2 Opcode Bypass — RCE via Pickle Extension Registry

Summary

ModelScan's pickle scanner only inspects GLOBAL, INST, and STACK_GLOBAL opcodes to detect dangerous module/function references. It completely ignores EXT1, EXT2, and EXT4 opcodes.

This MLflow model uses copyreg.add_extension() to register os.system in pickle's extension registry, then loads it via the EXT2 opcode — which ModelScan never examines. The result: arbitrary OS command execution with zero detection.

Attack Chain

1. copyreg.add_extension('os', 'system', 31337) registers os.system under external code 31337
2. EXT2 31337 opcode loads os.system from the registry — invisible to ModelScan
3. REDUCE calls os.system('cmd') — command executed

Why ModelScan Fails

ModelScan analyzes only three opcode types:

• GLOBAL → module\nname\n
• INST → module\nname\n
• STACK_GLOBAL → walks backwards for string operands

EXT1, EXT2, and EXT4 opcodes are completely absent from the scanner code. The dangerous os.system reference is loaded through the extension registry and never appears as a module/name pair in the opcode stream.

Verification

# ModelScan says CLEAN
modelscan -p model.pkl
# Output: No issues found! 🎉

# pickle.load() triggers RCE
python3 -c "
import pickle
with open('model.pkl', 'rb') as f:
    pickle.load(f)
"
# Output: EXT2_PWNED

Impact

• Severity: Critical (CVSS 9.8)
• Novel technique: Not covered in any known CVE, GHSA, or security advisory
• Remote, no auth needed, no user interaction
• Scissors past all unsafe_globals restrictions