| --- |
| license: mit |
| tags: |
| - security-research |
| - vulnerability-poc |
| --- |
| |
| # Security PoC (MLflow statsmodels pickle safety bypass) |
|
|
| **This is a security proof-of-concept model, NOT a real ML model.** |
|
|
| This MLflow statsmodels-flavor model demonstrates that `MLFLOW_ALLOW_PICKLE_DESERIALIZATION=false` is silently bypassed by the statsmodels flavor. When loaded via `mlflow.pyfunc.load_model()`, the model executes a benign marker-write payload proving arbitrary code execution. |
|
|
| ## Vulnerability |
|
|
| MLflow documents `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` as a global protection. When set to `false`, loading any pickle-based model should raise an error. The statsmodels flavor (`mlflow/statsmodels/__init__.py`) never consults this toggle -- it calls `smio.load_pickle()` unconditionally. |
|
|
| ## Reproduction |
|
|
| ```bash |
| pip install mlflow==3.14.0 statsmodels |
| export MLFLOW_ALLOW_PICKLE_DESERIALIZATION=false |
| python -c "import mlflow; mlflow.pyfunc.load_model('<this-repo-path>')" |
| # marker file written to /tmp/aisc0005_mfv_pwned |
| ``` |
|
|
| ## Impact |
|
|
| A deployer who hardened via `=false` still gets arbitrary code execution when a statsmodels-flavor model is loaded, including via the pyfunc scoring server. |
|
|
| ## Responsible disclosure |
|
|
| Submitted via huntr.com Model File Format program. |
|
|
