bilisheep

Add ONNX path traversal PoC for security research

43b0116 8 months ago

3.98 kB

license: apache-2.0
tags:
  - security-research
  - vulnerability-poc
  - onnx
  - path-traversal

🔴 ONNX Path Traversal Vulnerability PoC

⚠️ WARNING: This model is a PROOF-OF-CONCEPT for security research purposes only.

Vulnerability Summary

Type: Path Traversal / Arbitrary File Write (CWE-22)
Severity: CRITICAL (CVSS 9.1)
Affected: onnx-python library save_model() function
CVE: Pending assignment
Discovery Date: 2025-12-15

Description

This model demonstrates a critical path traversal vulnerability in the ONNX Python library. When a user loads this model with load_external_data=False and subsequently saves it using onnx.save_model(), the library writes arbitrary file content to a path controlled by the attacker.

Root Cause

The vulnerability exists in onnx/external_data_helper.py:194:

# VULNERABLE CODE - No path validation
external_data_file_path = os.path.join(base_path, info.location)

The load path has robust C++ validation (resolve_external_data_location), but the save path has no validation whatsoever.

Exploitation Steps

import onnx

# 1. Victim downloads this model
model = onnx.load("malicious_model.onnx", load_external_data=False)
#    ^ Bypasses path validation

# 2. Victim performs some operation and saves
onnx.save_model(model, "/home/victim/output.onnx")
#    ^ Triggers path traversal

# 3. Result: Arbitrary file overwrite
#    File written to: /home/victim/../../<attacker-controlled-path>

Impact

Arbitrary File Write: Attacker can overwrite any file writable by the victim
Remote Code Execution: Via SSH key injection, cron job injection, or shell rc files
Privilege Escalation: Potential escalation in multi-user environments
Supply Chain Risk: Malicious models in ML pipelines

Affected Scenarios

✅ Model sharing platforms (Hugging Face, GitHub)
✅ Model conversion services
✅ ML training pipelines with model optimization
✅ Jupyter Notebooks processing external models
✅ Automated CI/CD systems

Detection

Scan models with this script:

import onnx

def is_malicious(model_path):
    model = onnx.load(model_path, load_external_data=False)
    for tensor in get_all_tensors(model):
        for entry in tensor.external_data:
            if entry.key == "location" and ".." in entry.value:
                return True  # Path traversal detected
    return False

Remediation

For ONNX Maintainers

# Fix: Reuse the load-path validator in save path
def save_external_data(tensor, base_path):
    info = ExternalDataInfo(tensor)

    # Add validation before file write
    external_data_file_path = c_checker._resolve_external_data_location(
        base_path, info.location, tensor.name
    )
    # Now safe to write...

For Users

Always use load_external_data=True (enables validation)
Run onnx.checker.check_model() before saving
Only use models from trusted sources
Implement SHA256 verification
Sandbox untrusted model processing

Timeline

2025-12-15: Vulnerability discovered during security audit
2025-12-15: PoC created for responsible disclosure
TBD: Vendor notification
TBD: CVE assignment
TBD: Public disclosure after patch

Ethical Disclosure

This PoC is shared with:

✅ Gated access control (manual review required)
✅ Clear warnings and documentation
✅ Safe payload (creates marker file only)
✅ Coordination with ProtectAI security team

DO NOT use this PoC against systems you don't own.

References

Full security audit report: [Link to report]
CWE-22: https://cwe.mitre.org/data/definitions/22.html
ONNX GitHub: https://github.com/onnx/onnx

Contact

For security concerns: [Your responsible disclosure contact]

This model is part of responsible security research to improve ML ecosystem security.