etwithin/mlflow-scanner-bypass-poc

MLFlow Scanner Bypass PoC

Vulnerability

Malicious pickle in MLFlow model's python_model.pkl achieves ACE while bypassing both scanners.

Scanner Bypass

• modelscan 0.8.8: 0 issues on python_model.pkl (marshal+FunctionType chain bypasses detection)
• picklescan 1.0.4: 0 infected files

ACE on Load

import mlflow
model = mlflow.pyfunc.load_model("./")  # ACE triggered during pickle deserialization

Payload Chain

importlib.import_module → marshal.loads → types.FunctionType → arbitrary code execution

Environment

• MLFlow 3.10.1
• modelscan 0.8.8
• picklescan 1.0.4
• Python 3.12.8