File size: 1,040 Bytes
ddc0031 | 1 2 3 4 5 6 7 8 9 | # PoC - modelscan nested-zip coverage bypass on PyTorch archives (BL-0107)
Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.
- Scanner: modelscan==0.8.8 (modelscan.py). Format: PyTorch Archive (.mar) / Torch Export (.pt2).
- `modelscan -p evilmodel_zip.mar` -> issues=[], 'No issues found', while torch.load / TorchServe loads the embedded zip-format `.pt` member and runs its __reduce__. modelscan recurses only one level: a member that is itself a zip is recorded as a non-fatal NestedZipError and skipped (modelscan.py:103-110). The identical inner pickle scanned at top level is flagged CRITICAL (posix.system) - so the nested 'clean' is a genuine miss.
- Benign: the embedded __reduce__ only touches a marker file. NOTE: modelscan prints 'does not support nested zip files' and exits 3 here; the security issue is that the issues array / summary that gate logic consumes shows the malicious .mar as clean.
Files: evilmodel_zip.mar (.mar vector), evil_sampleinput.pt2 (.pt2 vector). Full report in huntr submission. |