PoC - modelscan nested-zip coverage bypass on PyTorch archives (BL-0107)
Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.
- Scanner: modelscan==0.8.8 (modelscan.py). Format: PyTorch Archive (.mar) / Torch Export (.pt2).
modelscan -p evilmodel_zip.mar -> issues=[], 'No issues found', while torch.load / TorchServe loads the embedded zip-format .pt member and runs its reduce. modelscan recurses only one level: a member that is itself a zip is recorded as a non-fatal NestedZipError and skipped (modelscan.py:103-110). The identical inner pickle scanned at top level is flagged CRITICAL (posix.system) - so the nested 'clean' is a genuine miss.- Benign: the embedded reduce only touches a marker file. NOTE: modelscan prints 'does not support nested zip files' and exits 3 here; the security issue is that the issues array / summary that gate logic consumes shows the malicious .mar as clean.
Files: evilmodel_zip.mar (.mar vector), evil_sampleinput.pt2 (.pt2 vector). Full report in huntr submission.
