hoanghai2110/scanner-bypass-poc

Scanner Bypass PoC

This is a security research submission for Huntr.

Vulnerability

ModelScan scan_pickle_bytes() logic bug: when genops() crashes mid-stream with pre-existing benign globals, the function returns total_issues=0, errors=[] — indistinguishable from a clean file — while containing a malicious payload.

File

• huntr_submission.pkl — malicious pickle that bypasses ModelScan completely

Scanner result (expected vs actual)

Expected: errors=[PickleGenopsError], total_issues=0
Actual:   errors=[],                  total_issues=0  ← CLEAN result

Reproduction

from modelscan.modelscan import ModelScan
ms = ModelScan()
result = ms.scan("huntr_submission.pkl")
print(result["summary"]["total_issues"])  # → 0
print(result["errors"])                   # → []

import pickle
pickle.loads(open("huntr_submission.pkl", "rb").read().split(b"\xfe")[1])
# → executes malicious code