| --- |
| license: apache-2.0 |
| tags: [security, proof-of-concept, modelscan] |
| --- |
| |
| # PoC — modelscan fails **open** on `.npy` under numpy >= 2 |
|
|
| Proof-of-concept for a **huntr Model File Vulnerabilities (MFV)** report against |
| [`modelscan`](https://github.com/protectai/modelscan) **0.8.8**. |
|
|
| Payload is deliberately harmless: it runs `echo NPY_EXEC_OK`. No network access, no deletion, |
| nothing written outside the working directory. |
|
|
| ## The issue |
|
|
| `modelscan/tools/picklescanner.py:234` calls a **private numpy API**: |
|
|
| ```python |
| np.lib.format._check_version(version) # type: ignore[attr-defined] |
| ``` |
|
|
| `numpy` **2.0 removed `_check_version`**. Under numpy >= 2 the call raises |
| `AttributeError`, the `.npy` scanner aborts — and modelscan still prints an affirmative |
| clean verdict. The error is relegated to a secondary `Errors` section and the skipped |
| count is hidden behind `--show-skipped`. |
|
|
| `pip install modelscan` today resolves numpy 2.x by default, so a default install |
| returns a clean verdict for **any** malicious `.npy`. |
|
|
| ## Measured differential — identical file, only numpy differs |
|
|
| | numpy | modelscan 0.8.8 verdict | |
| |---|---| |
| | **2.5.1** | ` No issues found! 🎉` + `Errors: module 'numpy.lib.format' has no attribute '_check_version'` + `Total skipped: 1` | |
| | **1.26.4** | `CRITICAL: 1` — *Use of unsafe operator 'system' from module 'posix'* | |
|
|
| ## Reproduce |
|
|
| ```bash |
| python -m venv v2 && ./v2/bin/pip install modelscan==0.8.8 numpy==2.5.1 |
| ./v2/bin/python generate_poc.py |
| ./v2/bin/modelscan -p poc_object_array.npy # "No issues found!" <-- fails open |
| |
| python -m venv v1 && ./v1/bin/pip install modelscan==0.8.8 numpy==1.26.4 |
| ./v1/bin/modelscan -p poc_object_array.npy # CRITICAL: unsafe operator 'system' |
| ``` |
|
|
| ## Suggested fix |
|
|
| - Stop calling the private `np.lib.format._check_version`; gate on `numpy.__version__` or |
| drop the check (`_read_array_header` already validates the version). |
| - **Fail closed:** a scanner that raised must not yield an affirmative "No issues found" |
| summary. Surface aborted scans in the main verdict. |
|
|
| ## Attribution |
|
|
| Cyfra Tech Solutions (Roman Arce Bran), Costa Rica. |
|
|
