Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,56 @@
+---
+library_name: mlflow
+tags:
+- security-research
+- modelscan-bypass
+- copyreg
+- ext2
+- pickle-registry
+- rce
+---
+
+# ModelScan EXT2 Opcode Bypass — RCE via Pickle Extension Registry
+
+## Summary
+
+ModelScan's pickle scanner only inspects **GLOBAL**, **INST**, and **STACK_GLOBAL** opcodes to detect dangerous module/function references. It completely ignores **EXT1**, **EXT2**, and **EXT4** opcodes.
+
+This MLflow model uses `copyreg.add_extension()` to register `os.system` in pickle's extension registry, then loads it via the **EXT2** opcode — which ModelScan never examines. The result: arbitrary OS command execution with zero detection.
+
+## Attack Chain
+
+1. `copyreg.add_extension('os', 'system', 31337)` registers os.system under external code 31337
+2. `EXT2 31337` opcode loads os.system from the registry — **invisible to ModelScan**
+3. REDUCE calls `os.system('cmd')` — command executed
+
+## Why ModelScan Fails
+
+ModelScan analyzes only three opcode types:
+- `GLOBAL` → `module\nname\n`
+- `INST` → `module\nname\n`
+- `STACK_GLOBAL` → walks backwards for string operands
+
+**EXT1, EXT2, and EXT4 opcodes are completely absent from the scanner code.** The dangerous `os.system` reference is loaded through the extension registry and never appears as a module/name pair in the opcode stream.
+
+## Verification
+
+```bash
+# ModelScan says CLEAN
+modelscan -p model.pkl
+# Output: No issues found! 🎉
+
+# pickle.load() triggers RCE
+python3 -c "
+import pickle
+with open('model.pkl', 'rb') as f:
+    pickle.load(f)
+"
+# Output: EXT2_PWNED
+```
+
+## Impact
+
+- **Severity**: Critical (CVSS 9.8)
+- **Novel technique**: Not covered in any known CVE, GHSA, or security advisory
+- Remote, no auth needed, no user interaction
+- Scissors past all unsafe_globals restrictions