Kanisia/caffe-hdf5output-model-poc

Caffe HDF5Output Load-Time Arbitrary File Overwrite

This PoC demonstrates that an untrusted Caffe .prototxt can create or truncate an attacker-selected filesystem path while the network is being loaded. No inference call is required.

The crafted network contains an HDF5Output layer whose hdf5_output_param.file_name is /poc/victim.txt. During caffe.Net(..., caffe.TEST) construction, Caffe calls the layer's LayerSetUp() method. That method passes the model-controlled path directly to:

H5Fcreate(file_name_.c_str(), H5F_ACC_TRUNC, H5P_DEFAULT, H5P_DEFAULT);

H5F_ACC_TRUNC replaces the existing file with a new HDF5 file. The loader does not restrict the path to the model directory and does not require the caller to opt in to output behavior.

Files

• malicious.prototxt - crafted Caffe model definition.
• build_and_verify.py - CPU-only reproducer and verifier.
• verify_report.json - generated verification evidence.
• victim.txt - generated local control file; it is deliberately overwritten.

Reproduction

Docker Desktop must be running. The script uses the public CPU-only bvlc/caffe:cpu image and pulls it automatically if it is not present.

C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe build_and_verify.py

The script first writes a 40-byte text marker to victim.txt, loads only the crafted network, and then verifies all of the following:

• caffe.Net() returns successfully.
• victim.txt changes without any inference call.
• The replacement begins with the HDF5 magic bytes 89 48 44 46 0d 0a 1a 0a.
• verify_report.json records "verified": true.

Impact

An application that accepts and loads an untrusted Caffe .prototxt can be made to create or destructively overwrite any file writable by its process. The effect occurs during model initialization, before inference. This can destroy configuration, data, checkpoints, or other application files and can be combined with writable-path or file-consumer conditions for greater integrity impact.