bayramshirinov/modelscan-bypass-poc

PoC — ModelScan STACK_GLOBAL memo-poisoning fail-open bypass

Security research PoC for the huntr Model File Formats (scanner-bypass) program. Demonstrates that ProtectAI ModelScan (main @ 61fcec9) reports a malicious model file as 0 issues while the file executes os.system when loaded. The payload here is benign: it writes poc_executed.txt to prove code execution — nothing harmful.

Files

• sklearn_model.joblib — the PoC model file (memo-poisoned pickle, benign os.system marker payload).
• verify.py — one-command reproducer: builds the file, scans it with ModelScan (0 issues) plus a control os.system pickle (CRITICAL), then loads it to show the marker file appears.
• README.md — this file.

Reproduce

pip install "modelscan"     # needs Python 3.10–3.12; joblib optional
python verify.py

Expected:

[SCAN] sklearn_model.joblib      -> total_issues = 0   (scanner error: "argument of type 'int' is not iterable")
[SCAN] control_os_system.pkl     -> total_issues = 1   {CRITICAL: 1}
[EXEC] joblib.load(...) -> poc_executed.txt present: True
  CONFIRMED: undetected code-execution model file.

What / why (short)

ModelScan's pickle scanner re-implements the pickle memo and stores the preceding opcode's argument instead of the resolved stack value (modelscan/tools/picklescanner.py:81-82). A BINGET-before-BINPUT poisons its memo with an integer index; STACK_GLOBAL then yields an int (module,name) tuple, and the guard "unknown" in <int> (:184) raises a TypeError that aborts the issue-builder before any issue is recorded — a fail-open crash that suppresses ALL detections for the file. CPython's real unpickler stores the resolved strings, so the same bytes resolve STACK_GLOBAL → os.system and REDUCE runs it on load.

Full write-up (root cause, fix) accompanies the huntr report.

All testing was done locally against ProtectAI's own published source; the payload is benign; no third-party system was touched.