| # PoC - modelscan nested-zip coverage bypass on PyTorch archives (BL-0107) | |
| Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only. | |
| - Scanner: modelscan==0.8.8 (modelscan.py). Format: PyTorch Archive (.mar) / Torch Export (.pt2). | |
| - `modelscan -p evilmodel_zip.mar` -> issues=[], 'No issues found', while torch.load / TorchServe loads the embedded zip-format `.pt` member and runs its __reduce__. modelscan recurses only one level: a member that is itself a zip is recorded as a non-fatal NestedZipError and skipped (modelscan.py:103-110). The identical inner pickle scanned at top level is flagged CRITICAL (posix.system) - so the nested 'clean' is a genuine miss. | |
| - Benign: the embedded __reduce__ only touches a marker file. NOTE: modelscan prints 'does not support nested zip files' and exits 3 here; the security issue is that the issues array / summary that gate logic consumes shows the malicious .mar as clean. | |
| Files: evilmodel_zip.mar (.mar vector), evil_sampleinput.pt2 (.pt2 vector). Full report in huntr submission. |