Vulnerable code sample

import os
import sys

# This is a simplified, conceptual representation of the vulnerability
# described in the fictitious CVE-2025-54412.
# It simulates a deserialization process where a node's type is checked
# based on one attribute, but the execution is triggered from another,
# unchecked attribute.

# A list of types/functions that are considered "safe" to load.
# In a real scenario, this would be more extensive.
ALLOWED_TYPES = [
    "numpy.array",
    "numpy.float64",
    "sklearn.linear_model.LogisticRegression",
]

# This class represents a node in the serialized object graph.
# In the vulnerable version, it has an inconsistency between the
# function name it presents for security checks and the actual
# operator it holds for execution.
class OperatorFuncNode:
    def __init__(self, trusted_func_name, unsafe_operator_func):
        # This attribute holds a string representation of a function.
        # The deserializer will check if this string is in the ALLOWED_TYPES list.
        self.trusted_func_name = trusted_func_name

        # This attribute holds the ACTUAL function/callable to be executed.
        # The vulnerability lies in the fact that this is executed without
        # being validated against the trusted_func_name.
        self.unsafe_operator_func = unsafe_operator_func

    def __repr__(self):
        return f"OperatorFuncNode(trusted_func_name='{self.trusted_func_name}')"

# This function simulates the vulnerable loading mechanism in skops < 0.12.0.
def vulnerable_skops_load(node):
    """
    Simulates the vulnerable loading process.
    1. It checks if the `trusted_func_name` is in an allow-list.
    2. If it is, it proceeds to execute the `unsafe_operator_func`
       without verifying that it corresponds to the trusted name.
    """
    print(f"--> Verifying node: {node!r}")
    if node.trusted_func_name in ALLOWED_TYPES:
        print(f"--> Check passed: '{node.trusted_func_name}' is an allowed type.")
        print("--> Executing the associated operator function...")
        # THE VULNERABILITY:
        # The code executes the `unsafe_operator_func` which is not
        # guaranteed to be related to `trusted_func_name`.
        # An attacker controls both fields.
        try:
            result = node.unsafe_operator_func()
            print("--> Execution finished.")
            return result
        except Exception as e:
            print(f"--> Execution failed with error: {e}")
            return None
    else:
        print(f"--> Check failed: '{node.trusted_func_name}' is not an allowed type.")
        raise TypeError(f"Untrusted type encountered: {node.trusted_func_name}")


# --- Attacker's Payload ---

def create_malicious_payload():
    """
    This function crafts the malicious node to exploit the vulnerability.
    """
    print("\n[ATTACKER] Crafting malicious payload...")

    # The attacker's goal is to execute `os.system`.
    # This is the malicious function they want to run on the victim's machine.
    malicious_function = lambda: os.system('echo "[*] PWNED: Arbitrary code execution successful!"')

    # The attacker creates the node.
    # 1. They set `trusted_func_name` to a value that WILL pass the security check.
    # 2. They set `unsafe_operator_func` to their malicious function.
    exploit_node = OperatorFuncNode(
        trusted_func_name="numpy.array",  # A seemingly safe and allowed type
        unsafe_operator_func=malicious_function  # The hidden malicious callable
    )

    print("[ATTACKER] Payload created. It looks like a safe 'numpy.array' but hides a system call.")
    return exploit_node


if __name__ == "__main__":
    print("--- DEMONSTRATING CVE-2025-54412 (Conceptual) ---")
    print("Simulating a victim loading a malicious model file.\n")

    # 1. The attacker creates a malicious file (here, just the node object).
    malicious_node = create_malicious_payload()

    print("\n[VICTIM] Loading a model from an untrusted source...")
    # 2. The victim's application uses the vulnerable loading function.
    vulnerable_skops_load(malicious_node)
    print("\n[VICTIM] 'Model' loaded without any apparent security error.")