wladislax/joblib-modelscan-bypass-ace-poc

⚠️ Security PoC — NOT a usable model

Proof-of-concept malicious .joblib files for a huntr "Model Format Vulnerability" submission (Protect AI / Palo Alto Prisma AIRS). They achieve arbitrary code execution on joblib.load() while being reported clean by Protect AI ModelScan. Published only for responsible-disclosure reproduction. Do not load them on a machine you care about.

What it demonstrates

joblib.load() deserializes via pickle, so an object's __reduce__ runs code on load. ModelScan's pickle scanner is a module-name denylist; choosing a code-execution gadget whose module is not on that denylist yields RCE that ModelScan does not flag.

File	Gadget	ModelScan
poc.joblib	pydoc.pipepager(text, cmd) → subprocess.Popen(cmd, shell=True)	0 issues
poc2_cprofile.joblib	cProfile.run(stmt) → exec(stmt)	0 issues
naive_os_system.joblib	os.system(cmd) (contrast)	CRITICAL — detected

The two gadgets show the bypass is structural: patching one module does not close the class. The proof command is non-destructive — it only writes a marker file.

Reproduce

python -m pip install joblib modelscan
python load_poc.py poc.joblib        # -> writes joblib_poc_pwned.txt  (RCE)
modelscan -p poc.joblib -r json      # -> total_issues: 0  (bypass)
modelscan -p naive_os_system.joblib  # -> CRITICAL  (control is caught)

Files

• poc.joblib — RCE via pydoc.pipepager, bypasses ModelScan
• poc2_cprofile.joblib — RCE via cProfile.run, bypasses ModelScan
• naive_os_system.joblib — control payload ModelScan flags CRITICAL
• make_joblib_poc.py — regenerates all three deterministically
• load_poc.py — minimal loader proving execution