coreml-mlpackage-symlink-lfi-poc

Core ML .mlpackage Symlink Dereference PoC

This repository contains a benign Core ML package proof for coremltools==9.0. The PoC does not execute code, persist state, access credentials, or make network calls. It demonstrates that a model package can carry a symlink that is dereferenced when the package is loaded and re-saved.

Summary

The model package symlink_lfi.mlpackage is otherwise loadable, but it contains an extra symlink inside the package:

symlink_lfi.mlpackage/Data/com.apple.CoreML/weights/copied_host_marker.txt
  -> ../../../../reviewer_host_marker.txt

That target is outside the .mlpackage directory but inside this cloned repository. When a consumer loads the package with coremltools.models.MLModel(..., skip_model_load=True) and re-saves it with MLModel.save(), coremltools copies the symlink target contents into the output package as a regular file.

Affected Format

• Format: Core ML package (.mlpackage)
• Tested target: coremltools==9.0
• Trigger path: coremltools.models.MLModel(..., skip_model_load=True) followed by MLModel.save(...)
• Impact class: local file inclusion / unintended file copy during package re-save

Security Impact

An untrusted .mlpackage can include a symlink in a package subdirectory. A workflow that clones or downloads the package preserving symlinks, loads it with coremltools, and re-saves it can copy the symlink target into the output model package as ordinary file contents. This can disclose files reachable from the package path into a generated model artifact.

This PoC uses a harmless repository-local marker file for portability. It does not attempt to read secrets or system files.

Reproduce

From this directory:

python verify_coreml_symlink_lfi.py --scanner --git-check

Verifier scratch files are written under _verify_output/, which is intentionally ignored by git.

Expected impact fields:

copied_exists: true
copied_is_symlink: false
copied_sha256 == marker_sha256
git_mode: 120000

The --git-check mode initializes a local git repository from this folder, commits the package, clones it, verifies that git preserves the symlink as mode 120000, and repeats the Core ML save proof from the clone.

Artifact Details

• Marker file: reviewer_host_marker.txt
• Package: symlink_lfi.mlpackage
• Symlink entry: symlink_lfi.mlpackage/Data/com.apple.CoreML/weights/copied_host_marker.txt
• Symlink target: ../../../../reviewer_host_marker.txt

After MLModel.save(), the corresponding output path exists as a regular file, not a symlink, and its SHA256 equals the marker file's SHA256.

Tested Versions

Python 3.12.3
coremltools 9.0
modelscan 0.8.8
protobuf 7.34.1
numpy 1.26.4
scikit-learn 1.5.1

Limitation

This is a local-file disclosure/copy primitive during model package re-save, not arbitrary code execution. The staged symlink is relative for reviewer portability; separate lab evidence also verifies absolute symlinks and symlinked directories.