Add README.md

README.md

@@ -0,0 +1,61 @@
+# PoC: Caffe PythonLayer Arbitrary Code Execution (CWE-94)
+
+## Vulnerability
+
+BVLC/caffe's `GetPythonLayer()` in `layer_factory.cpp:295` calls `bp::import()` with an attacker-controlled module name read from a `.prototxt` model file. When a victim loads a crafted `.prototxt`, Python's import mechanism executes all top-level code in the specified module, achieving arbitrary code execution.
+
+```cpp
+// layer_factory.cpp:295 — no sanitization, no allowlist
+bp::object module = bp::import(param.python_param().module().c_str());
+bp::object layer = module.attr(param.python_param().layer().c_str())(param);
+```
+
+- **CWE-94:** Improper Control of Generation of Code (Code Injection)
+- **CVSS:** 8.8 (High)
+- **Condition:** Requires `WITH_PYTHON_LAYER=1` compile flag (commonly enabled for custom layers)
+- **Repository:** https://github.com/BVLC/caffe (archived, last commit 2020)
+
+## Files
+
+| File | Description |
+|------|-------------|
+| `evil_layer.py` | Malicious Python module — top-level code executes on import |
+| `poc_rce.prototxt` | Caffe model config that references the malicious module |
+
+## Reproduction
+
+```bash
+# Requires Caffe built with WITH_PYTHON_LAYER=1
+cd /path/to/this/directory
+caffe test -model poc_rce.prototxt -iterations 1 2>/dev/null
+cat /tmp/caffe_rce_proof.txt
+```
+
+Or via Python:
+
+```python
+import caffe
+net = caffe.Net('poc_rce.prototxt', caffe.TEST)
+# → evil_layer.py top-level code executes immediately
+```
+
+## Attack Scenario
+
+1. Attacker distributes a model package (`.prototxt` + `.py` module)
+2. The `.prototxt` contains a Python layer referencing the included module
+3. Victim loads the model for inference
+4. `bp::import()` triggers Python import → all top-level code in the module executes
+5. Full RCE with the victim's privileges
+
+## Root Cause
+
+The `PythonParameter` protobuf message allows arbitrary module and layer names:
+
+```protobuf
+message PythonParameter {
+  optional string module = 1;   // → bp::import(module)
+  optional string layer = 2;    // → module.attr(layer)(param)
+}
+```
+
+No validation, no allowlist, no sandboxing is applied before the import.