Downloads · 30 days
0
aslein1413/poc-cntk-userfunction-rce
poc-cntk-userfunction-rce is a machine learning model from aslein1413. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Loading an untrusted CNTK v2 model with the normal cntk.Function.load() runs code embedded in the file. A CNTK graph can hold a Python UserFunction node, and the node stores the function's module and class as plain st…
Downloads · 30 days
0
Access
Public
Updated Jul 16, 2026
Repo size
—
Likes
0
Public
Click a slice to open those files.
.py4.6 KB · 44%
From the Hugging Face model README
Loading an untrusted CNTK v2 model with the normal cntk.Function.load() runs code
embedded in the file. A CNTK graph can hold a Python UserFunction node, and the node
stores the function's module and class as plain strings. On load CNTK's UDF
deserializer does exec("from {module} import {class}") on those attacker-controlled
strings, so the file alone decides what gets imported and run.
model_inject_linux.cntk needs no external file: the module is byte-patched to
builtins and the class string carries a newline-injected payload, so loading it
runs os.system('id ...') and drops /tmp/PWNED_cntk.
model_inject_linux.cntk — self-contained malicious model (stdlib-only, no attacker .py).verify.py — loads it and prints the marker.model_evil.cntk + evil_udf.py — the planted-module variant (module named in the model is imported from sys.path).build_inject_linux.py — how the injected model was built.Dockerfile — the exact clean-room image (python:3.6 + cntk 2.7 + OpenMPI 1.10).CNTK 2.7 is py3.5/3.6 only. In the clean room I confirmed it on a stock wheel:
docker build -t cntk-poc . # python:3.6-slim + pip install cntk==2.7 + OpenMPI 1.10
docker run --rm -v "$PWD":/poc -w /poc cntk-poc python verify.py
# marker after : True
# uid=0(root) gid=0(root) groups=0(root)
# INJECTED_NO_EXTERNAL_FILE
Or on any py3.6 box: pip install cntk==2.7 then python verify.py.
Any service that loads a user-supplied .cntk runs attacker code as the loading process.
It is the default load path, no flag turns it off, and ModelScan does not scan .cntk
at all, so the file looks clean.