ModelScan Bypass - Memory-Mapped Array ⭐ PRIMARY FINDING
Security Research - ModelScan Bypass Technique
Overview
This repository contains a proof-of-concept demonstrating a bypass technique for ModelScan,
a popular ML model security scanner. This technique allows malicious pickle-based model files
to evade detection.
Technique
Memory-mapped array bypass
Uses joblib's memmap feature with malicious reduce method
ModelScan Result
SCANNED but found NO ISSUES ✅ (TRUE BYPASS)
File
exploit_memmap_bypass.joblib
Reproduction Steps
Testing with ModelScan
1# Install ModelScan
2pip install modelscan
3
4# Download the exploit file from this repository
5# Then scan it
6modelscan scan -p exploit_memmap_bypass.joblib
Expected Result
SCANNED but found NO ISSUES ✅ (TRUE BYPASS)
Triggering the Exploit (⚠️ DO NOT RUN ON PRODUCTION)
1import joblib
2
3# WARNING: This will execute arbitrary code!
4model = joblib.load('exploit_memmap_bypass.joblib')
Technical Details
This exploit uses Python's pickle __reduce__ method for RCE:
1def __reduce__(self):
2 import os
3 return (os.system, ('echo "RCE executed!"',))
Why ModelScan misses this:
Uses joblib's memmap feature with malicious reduce method
Security Impact
Severity: HIGH
Attack Vector:
- Attacker creates malicious model using this technique
- Uploads to model hub (HuggingFace, etc.)
- Victim downloads and scans with ModelScan
- Scanner reports "No issues found!" or skips the file
- Victim loads model → RCE
Part of Larger Research
This is one of four bypass techniques discovered:
- Compression Mismatch
- Double Compression
- Corrupt Header
- Memmap Bypass ⭐ - PRIMARY FINDING
Disclosure
This research is being submitted to Huntr's bug bounty program for responsible disclosure.
Date: December 25, 2024
Researcher: Security Research Team
References
Disclaimer
⚠️ For Security Research Only
This file is provided for security research and vulnerability disclosure purposes only.
Do not use this technique for malicious purposes. Loading this file will execute code.
Status: Under responsible disclosure to Huntr bug bounty program
