| # MLeap MathBinary pow trigger PoC | |
| This repo is a benign security research PoC for Huntr MFV triage. | |
| Files: | |
| - `control_model.json` | |
| - `control_node.json` | |
| - `trigger_model.json` | |
| - `trigger_node.json` | |
| - `verify_remote_poc.py` | |
| Tested trigger entrypoint: | |
| - `MathBinary().deserialize_from_bundle(...).transform(...)` | |
| Behavior: | |
| - control bundle uses `MathBinary(transform_type='mul')` | |
| - malicious bundle uses `MathBinary(transform_type='pow')` | |
| - trigger row `x=2.0, y=0.0` changes from `0.0` to `1.0` | |
| - benign rows like `y=1` and `x=y=2` stay equal | |
| ## Reproduction | |
| ```bash | |
| python3 verify_remote_poc.py --repo hacnho/mleap-mathbinary-pow-trigger-poc | |
| ``` | |
| ## Expected output delta | |
| - trigger: | |
| - `x=2.0, y=0.0` | |
| - control -> `[[0.0]]` | |
| - malicious -> `[[1.0]]` | |
| Representative benign rows that stay equal: | |
| - `(2.0, 1.0)` -> `[[2.0]]` | |
| - `(3.0, 1.0)` -> `[[3.0]]` | |
| - `(2.0, 2.0)` -> `[[4.0]]` | |
| - `(0.0, 1.0)` -> `[[0.0]]` | |
| - `(1.0, 1.0)` -> `[[1.0]]` | |