Upload README.md with huggingface_hub
Browse files
README.md
ADDED
|
@@ -0,0 +1,13 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
# PoC - modelaudit misses numpy.savez file-write-on-load (Pickle)
|
| 2 |
+
|
| 3 |
+
Coordinated disclosure PoC for huntr (Protect AI MFV). Benign payload only.
|
| 4 |
+
|
| 5 |
+
- Scanner under test: `modelaudit==0.2.49` (cross-checked `modelscan==0.8.8`), Python 3.11.15, numpy 2.4.6.
|
| 6 |
+
- Format: Pickle (.pkl).
|
| 7 |
+
- Two-sided behavior: `modelaudit scan evil_savez.pkl` -> **Clean / exit 0** (7/7 checks pass), but
|
| 8 |
+
`pickle.load(open('evil_savez.pkl','rb'))` writes a `.npz` to an attacker-controlled absolute path on load.
|
| 9 |
+
- Benign marker: the reduce calls `numpy.savez(<marker_path>, [13.37])` - a harmless array write. No destructive action.
|
| 10 |
+
- Root cause: modelaudit's pickle FILE_WRITE call-graph sink table (`_FILE_OPEN_SINK_EXACT`) omits `zipfile.ZipFile`,
|
| 11 |
+
so `numpy.savez`/`savez_compressed` (whose open is mediated by zipfile) evade the detector that catches `numpy.save`.
|
| 12 |
+
|
| 13 |
+
Files: `evil_savez.pkl` (scan Clean), `build_gadgets.py` (builder). Full report + positive control in the huntr submission.
|