ModelScan Bypass - Double Compression
Security Research - ModelScan Bypass Technique
Overview
This repository contains a proof-of-concept demonstrating a bypass technique for ModelScan,
a popular ML model security scanner. This technique allows malicious pickle-based model files
to evade detection.
Technique
Nested/double compression
Payload compressed twice (gzip then bz2)
ModelScan Result
SKIPPED - Scanner did not analyze this file
File
exploit_double_compression.joblib.gz.bz2
Reproduction Steps
Testing with ModelScan
1# Install ModelScan
2pip install modelscan
3
4# Download the exploit file from this repository
5# Then scan it
6modelscan scan -p exploit_double_compression.joblib.gz.bz2
Expected Result
SKIPPED - Scanner did not analyze this file
Triggering the Exploit (⚠️ DO NOT RUN ON PRODUCTION)
1import joblib
2
3# WARNING: This will execute arbitrary code!
4model = joblib.load('exploit_double_compression.joblib.gz.bz2')
Technical Details
This exploit uses Python's pickle __reduce__ method for RCE:
1def __reduce__(self):
2 import os
3 return (os.system, ('echo "RCE executed!"',))
Why ModelScan misses this:
Payload compressed twice (gzip then bz2)
Security Impact
Severity: HIGH
Attack Vector:
- Attacker creates malicious model using this technique
- Uploads to model hub (HuggingFace, etc.)
- Victim downloads and scans with ModelScan
- Scanner reports "No issues found!" or skips the file
- Victim loads model → RCE
Part of Larger Research
This is one of four bypass techniques discovered:
- Compression Mismatch
- Double Compression
- Corrupt Header
- Memmap Bypass ⭐ - PRIMARY FINDING
Disclosure
This research is being submitted to Huntr's bug bounty program for responsible disclosure.
Date: December 25, 2024
Researcher: Security Research Team
References
Disclaimer
⚠️ For Security Research Only
This file is provided for security research and vulnerability disclosure purposes only.
Do not use this technique for malicious purposes. Loading this file will execute code.
Status: Under responsible disclosure to Huntr bug bounty program
