modelscan-pickle-bypass-poc

ModelScan 0.8.8 Bypass — Pickle Deserialization RCE

Target: huntr.com (Protect AI Model Upload Program)

Reward Tier: $750 (Unsafe Deserialization — Scanner Bypass)

CWE: CWE-502 (Deserialization of Untrusted Data)

---

Executive Summary

ModelScan 0.8.8 is Protect AI's scanner for detecting unsafe operations in ML model files. It flags pickle files containing dangerous GLOBAL imports (e.g., os.system, subprocess.Popen) by analyzing pickle opcodes via pickletools.genops().

This report demonstrates a complete bypass of ModelScan 0.8.8's pickle scanner. The technique achieves arbitrary code execution via pickle.load() while producing zero ModelScan issues.

Status: ✅ ModelScan bypass confirmed | ✅ RCE confirmed

---

The Vulnerability

Python's pickle module is inherently unsafe — pickle.load() can execute arbitrary code by design. ModelScan attempts to detect this by scanning pickle opcodes for "unsafe" module imports.

Blocklist (from modelscan/settings.py)

Critical Gap: Modules NOT in the Blocklist

The following stdlib modules can be used for code execution but are completely absent from ModelScan's blocklist:

• ✅ marshal — marshal.loads() deserializes Python code objects
• ✅ types — types.FunctionType() creates executable functions from code objects
• ✅ ctypes — ctypes.CDLL(None).system() calls libc directly
• ✅ importlib — importlib.import_module('os') loads any module at runtime

---

Golden PoC: selfcontained_bypass_277.pkl

Verification

# RCE test (no dependencies)
python3.11 -c "import pickle; pickle.load(open('selfcontained_bypass_277.pkl','rb'))"
cat /tmp/huntr_bypass_poc  # → BYPASS_OK

# ModelScan bypass verification
modelscan scan -p selfcontained_bypass_277.pkl -r json
# → "total_issues": 0, "issues": []

Tested environment: CPython 3.11.15 + ModelScan 0.8.8 Note: marshal-based code objects are CPython minor-version specific; regenerate using build_selfcontained_pickle.py for the target Python minor version.

Technical Breakdown

The pickle uses only 2 GLOBAL imports, neither blocked:

Execution chain:

pickle.load()
  → marshal.loads(embedded_code_bytes)   # NOT scanned
  → types.FunctionType(code_obj, {})     # NOT scanned  
  → function() → import os → os.system() # Runtime, invisible to scanner

The embedded code object (232 bytes) contains a compiled function that imports os and calls os.system() at runtime — ModelScan never sees these opcodes because they don't exist in the pickle stream.

Alternative Bypass Variants

All confirmed 0 issues on ModelScan 0.8.8:

---

Reproduction

Requirements

• Python 3.8+
• modelscan>=0.8.0 (optional, for verification)
• No additional dependencies

Step 1: Verify RCE

python3.11 -c "import pickle; pickle.load(open('selfcontained_bypass_277.pkl','rb'))"
cat /tmp/huntr_bypass_poc  # → BYPASS_OK

Step 2: Verify ModelScan bypass

modelscan scan -p selfcontained_bypass_277.pkl -r json
# Expected: "total_issues": 0

Step 3: Reproduce from scratch

python3.11 build_selfcontained_pickle.py
# Builds the 277-byte payload from source code (CPython version-specific)

---

Deliverable Files

Impact

• Any application using pickle.load(), joblib.load(), or torch.load() on untrusted files is vulnerable
• ModelScan 0.8.8 provides zero protection against this attack
• The technique works against ALL pickle-compatible scanners that only check GLOBAL opcodes
• Alternate bypasses: ctypes, importlib, builtins (partially)

Mitigation

• Do NOT rely on static pickle analysis for security — pickle is inherently unsafe
• Use alternative formats: .safetensors, ONNX, or signed pickles
• Run model loading in isolated sandboxes (containers, seccomp, AppArmor)
• Add marshal, types, ctypes, importlib to ModelScan's blocklist
• Implement behavioral analysis or dynamic taint tracking