ashfiexe/joblib-deserialization-vuln-poc

⚠️ SECURITY RESEARCH: Joblib Deserialization RCE Vulnerability

WARNING: This repository contains a malicious model file for security research purposes only.

🔴 CRITICAL SECURITY NOTICE

This is a Proof of Concept (PoC) demonstrating a critical Remote Code Execution (RCE) vulnerability in .joblib model files through unsafe pickle deserialization.

DO NOT load this model file unless you understand the security implications.

---

📋 Vulnerability Summary

Property	Value
Vulnerability Type	Arbitrary Code Execution (ACE) / Remote Code Execution (RCE)
Affected Format	.joblib
Attack Vector	Unsafe pickle deserialization
CVSS Score	9.8 (Critical)
Trigger Point	joblib.load()
Status	Submitted to bug bounty program

---

🎯 Description

The .joblib serialization format, commonly used for saving scikit-learn models and other Python objects, relies on Python's pickle module for deserialization. The pickle protocol is inherently unsafe when deserializing untrusted data because it can execute arbitrary Python code.

This PoC demonstrates how an attacker can:

1. Create a malicious .joblib file with embedded Python code
2. Upload it to a model repository (HuggingFace, ModelZoo, etc.)
3. Achieve Remote Code Execution when a victim loads the file

How It Works

The exploit leverages Python's __reduce__ method, which pickle calls during deserialization:

class MaliciousModel:
    def __reduce__(self):
        # Returns (callable, arguments)
        # Pickle will execute: exec(malicious_code)
        return (exec, (malicious_code,))

When joblib.load('weaponized_model.joblib') is called, the malicious code executes immediately.

---

📁 Repository Contents

• weaponized_model.joblib - Malicious model file (PoC)
• load_model_demo.py - Safe demonstration script with user confirmation
• REPRODUCTION.md - Detailed step-by-step reproduction guide

---

🔬 Reproduction Steps

Prerequisites

# Python 3.x required
pip install joblib numpy

Quick Test

import joblib

# ⚠️ WARNING: This triggers arbitrary code execution!
model = joblib.load('weaponized_model.joblib')

Safe Demonstration

Use the provided demo script with user confirmation:

python load_model_demo.py

What Happens?

When you run the code:

1. ✅ Immediate code execution upon joblib.load()
2. ✅ System information is displayed (OS, Python version, user, etc.)
3. ✅ Demonstrates full code execution capabilities
4. ✅ No user interaction required after loading

Expected: Model loads silently without side effects
Actual: Arbitrary Python code executes during deserialization

---

💥 Security Impact

An attacker exploiting this vulnerability can:

Impact	Description
🔓 Remote Code Execution	Execute arbitrary Python code on victim's system
📂 File System Access	Read, write, or delete files
🔑 Credential Theft	Access environment variables, config files, SSH keys
📡 Data Exfiltration	Send sensitive data to attacker-controlled servers
🦠 Malware Delivery	Download and execute additional payloads
🔗 Lateral Movement	Pivot to other systems in the network
💣 Supply Chain Attack	Poison widely-used models affecting thousands of users

---

🌐 Real-World Attack Scenarios

Scenario 1: Model Repository Poisoning

1. Attacker creates malicious model disguised as legitimate pre-trained model
2. Uploads to HuggingFace, GitHub, or other model repositories
3. Victim downloads and loads: model = joblib.load('model.joblib')
4. RCE achieved - attacker gains shell access

Scenario 2: Jupyter Notebook Attack

1. Malicious .joblib file shared in collaborative notebook
2. Data scientist loads model in trusted environment
3. Code executes with scientist's credentials and access

Scenario 3: Automated ML Pipeline

1. ML pipeline automatically downloads and loads models
2. Malicious model in pipeline triggers on scheduled run
3. Compromises production systems

---

🛡️ Mitigation & Defense

For Users

1. ✅ Never load .joblib files from untrusted sources
2. ✅ Verify model provenance with cryptographic signatures
3. ✅ Use safer formats like .safetensors, ONNX, or TensorFlow SavedModel
4. ✅ Sandbox model loading in isolated containers/VMs
5. ✅ Scan files with static analysis tools before loading

For Developers

1. ✅ Deprecate .joblib for untrusted models
2. ✅ Implement integrity checks (SHA256 hashes, signatures)
3. ✅ Add security warnings to documentation
4. ✅ Provide migration paths to safer formats
5. ✅ Educate users about pickle security risks

For Platform Operators

1. ✅ Scan uploaded models for malicious pickle payloads
2. ✅ Warn users when downloading .joblib files
3. ✅ Implement sandboxing for model previews
4. ✅ Require verified badges for trusted uploaders

---

🔍 Technical Details

Exploit Mechanism

# Attacker creates this:
class ExploitModel:
    def __reduce__(self):
        return (exec, ("import os; os.system('malicious_command')",))

# Victim runs this:
import joblib
model = joblib.load('malicious.joblib')  # Code executes here!

Why This Works

1. joblib.dump() uses pickle.dump() internally
2. Pickle serializes the __reduce__ method
3. joblib.load() calls pickle.load()
4. Pickle calls __reduce__() and executes returned callable
5. exec(malicious_code) runs with victim's privileges

Affected Components

• joblib: All versions (inherent to pickle design)
• scikit-learn: Models saved with joblib
• pickle: Python's built-in serialization module
• Any library using joblib for persistence

---

📚 References & Resources

• Python Pickle Security Warning - Official Python docs
• Joblib Documentation - Joblib serialization docs
• OWASP: Deserialization Vulnerabilities
• SafeTensors Format - Secure alternative
• CWE-502: Deserialization of Untrusted Data

---

⚖️ Responsible Disclosure

This vulnerability disclosure follows responsible security practices:

• ✅ Reported to appropriate bug bounty program
• ✅ Created for legitimate security research
• ✅ Intended to raise awareness and improve security
• ✅ Not exploited maliciously

---

🎓 Educational Use Only

This PoC is provided exclusively for:

✅ Permitted	❌ Prohibited
Security research	Malicious attacks
Educational purposes	Unauthorized access
Defensive testing	Data theft
Vulnerability disclosure	System compromise
Academic study	Malware distribution

---

📝 Disclaimer

This repository is for security research and educational purposes only.

• The author is not responsible for any misuse of this information
• Users must comply with all applicable laws and regulations
• Unauthorized access to computer systems is illegal
• Always obtain proper authorization before security testing

---

👤 Author

Created for security research and bug bounty program submission.

Submission Date: January 19, 2026
Program: Model File Vulnerability Bug Bounty (Beta)

---

📄 License

MIT License - For research and educational purposes only.

---

🔗 Additional Information

For more details on the vulnerability, reproduction steps, and technical analysis, see:

• REPRODUCTION.md - Detailed reproduction guide
• load_model_demo.py - Safe demonstration script

---

Remember: With great power comes great responsibility. Use this knowledge to make systems more secure, not to harm them.