01data-ai/mlflow_f005_pytorch_pickle_module_info_preguard_rce

MLflow F005 PyTorch pickle_module_info Pre-Guard RCE

Payload repository for Huntr / ProtectAI triage.

Finding

Pickle Guard Bypass via pickle_module_info.txt Module Injection in MLflow PyTorch Flavor _load_model() Enables Pre-Guard RCE.

Primary PoC

proof_f005.py

Vulnerable Model Structure

The PoC creates a malicious MLflow PyTorch model artifact with this structure:

evil_model/
  MLmodel
  code/
    evil.py
  data/
    model.pth
    pickle_module_info.txt

The attacker-controlled file contains:

data/pickle_module_info.txt
evil

MLflow reads this module name and imports it before the pickle deserialization guard runs.

Confirmed Behavior

Confirmed on MLflow 3.12.0.

The proof explicitly sets:

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False

Confirmed output includes:

UNIQUE_MARKER_F005_REAL_MLFLOW_RCE
load_model_exception_type: MlflowException
marker_exists_after: True
marker_content: uid=0(root) gid=0(root) groups=0(root)
F005_CONFIRMED: attacker module executed before pickle guard exception

The later MlflowException is not a mitigation. The attacker-controlled module already executed before the guard exception was raised.

Root Cause

The vulnerable order is:

mlflow.pytorch.load_model()
  -> add attacker-controlled model code/ directory to sys.path
  -> _load_model(data_path)
       -> read data/pickle_module_info.txt
       -> importlib.import_module(pickle_module_name)
       -> attacker code executes during import
       -> _load_by_pickle_check(False) runs too late
Why This Is Distinct

This is not a generic "pickle is unsafe" report.

The distinct issue is a pre-guard import of an attacker-controlled module name from pickle_module_info.txt. The exploit does not require successful torch.load() deserialization. Code execution happens before the pickle guard blocks loading.

Key Evidence Files
proof_f005.py
RAW/proof_f005_stdout.txt
RAW/proof_f005_stderr.txt
RAW/proof_f005_exit_code.txt
SRC/source_references_f005.txt
SOURCE_REFERENCES.md
ENVIRONMENT.txt
COMMANDS.md
REQUESTS_RESPONSES.md
SHA256SUMS.txt
Scope

Confirmed against:

Repository: mlflow/mlflow
Version: MLflow 3.12.0
Component: mlflow/pytorch/__init__.py
Primary API: mlflow.pytorch.load_model()
Security control bypassed: MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False
Impact

An attacker who can provide a crafted MLflow PyTorch model artifact can execute arbitrary Python code in the process loading the model, even when pickle deserialization has been explicitly disabled.

Potential impact includes:

execution as the MLflow process user
environment variable and secret theft
cloud credential theft
model artifact theft or tampering
model-serving or validation infrastructure compromise
CI/CD compromise

This repository intentionally contains only MLflow F005 PyTorch pickle_module_info.txt pre-guard RCE artifacts.