xiaoyaoes/modelscan-joblib-bypass

ModelScan Joblib Bypass — 3 Pickle-Based RCE Techniques

Three novel techniques that bypass modelscan's pickle scanner in JOBLIB format.

Bypass Summary

#	Technique	Module	unsafe_globals?	Modelscan
1	PyDLL PyRun_SimpleString	ctypes.PyDLL	NO	No issues
2	importlib + methodcaller	importlib, operator.methodcaller	NO	No issues
3	code.InteractiveInterpreter	code.InteractiveInterpreter	NO	No issues

PoC Files

• exploit_pydll.joblib — Uses ctypes.PyDLL(None).PyRun_SimpleString() to execute arbitrary Python via CPython C API
• exploit_importlib.joblib — Uses importlib.import_module('os') + operator.methodcaller('system', cmd) for shell RCE
• exploit_code_interpreter.joblib — Uses code.InteractiveInterpreter().runsource() to execute arbitrary Python

Verification

modelscan scan -p exploit_pydll.joblib
# -> "No issues found!"

Why They Work

modelscan's unsafe_globals blocklist does NOT include:

• ctypes → PyDLL/PyRun_SimpleString
• importlib → import_module
• operator.methodcaller (only attrgetter is blocked)
• code → InteractiveInterpreter

All three are standard library modules that can achieve full RCE.