| --- |
| license: other |
| tags: |
| - security-research |
| - mfv |
| - scanner-bypass |
| --- |
| |
| # CoreML .mlmodel MFV PoC — Authorized Security Research |
|
|
| **This repository contains a proof-of-concept for an authorized bug bounty submission.** |
|
|
| ## Authorization Statement |
|
|
| This is authorized security research conducted under the huntr.com / Protect AI Model File Vulnerability (MFV) bug bounty program. Protect AI publicly invites researchers to find vulnerabilities in ML security tooling. All proof-of-concept work runs locally. This is responsible disclosure — findings are reported to vendors for remediation. |
|
|
| ## Vulnerability Summary |
|
|
| - **Format:** Apple CoreML `.mlmodel` |
| - **Scanner Bypass:** picklescan 1.0.4 + modelscan 0.8.8 (DUAL BYPASS, all 4 scan modes) |
| - **Impact:** Arbitrary Code Execution when malicious `.mlmodel` file is loaded |
| - **Technique:** bzip2-compressed joblib payload — bzip2 header `BZh9` crashes picklescan's pickle parser before any dangerous globals are detected |
|
|
| ## How It Works |
|
|
| 1. `.mlmodel` extension is absent from picklescan's and modelscan's extension lists |
| 2. A bzip2-compressed joblib file is renamed to `.mlmodel` |
| 3. Both scanners report clean (all modes: direct scan + directory scan) |
| 4. `joblib.load()` transparently decompresses and deserializes → payload executes |
|
|
| ## Scanner Results |
|
|
| ``` |
| picklescan 1.0.4 -p malicious_model_final.mlmodel → Infected: 0, Dangerous globals: 0 |
| picklescan 1.0.4 -p ./ → Scanned: 0 |
| modelscan 0.8.8 -p malicious_model_final.mlmodel → No issues found! |
| modelscan 0.8.8 -p ./ → No issues found! |
| ``` |
|
|
| ## Files |
|
|
| - `malicious_model_final.mlmodel` — bzip2-compressed joblib payload with `.mlmodel` extension |
| - `poc-mlmodel.py` — reproduction script |
|
|
| ## Reproduction |
|
|
| ```bash |
| pip install joblib picklescan modelscan |
| python3 poc-mlmodel.py |
| picklescan -p malicious_model_final.mlmodel |
| modelscan -p malicious_model_final.mlmodel |
| python3 -c "import joblib; print('BEFORE'); joblib.load('malicious_model_final.mlmodel'); print('AFTER')" |
| ``` |
|
|
