bilisheep/onnx-path-traversal-poc

🔴 ONNX Path Traversal Vulnerability PoC

⚠️ WARNING: This model is a PROOF-OF-CONCEPT for security research purposes only.

Vulnerability Summary

• Type: Path Traversal / Arbitrary File Write (CWE-22)
• Severity: CRITICAL (CVSS 9.1)
• Affected: onnx-python library save_model() function
• CVE: Pending assignment
• Discovery Date: 2025-12-15

Description

This model demonstrates a critical path traversal vulnerability in the ONNX Python library. When a user loads this model with load_external_data=False and subsequently saves it using onnx.save_model(), the library writes arbitrary file content to a path controlled by the attacker.

Root Cause

The vulnerability exists in onnx/external_data_helper.py:194:

# VULNERABLE CODE - No path validation
external_data_file_path = os.path.join(base_path, info.location)

The load path has robust C++ validation (resolve_external_data_location), but the save path has no validation whatsoever.

Exploitation Steps

import onnx

# 1. Victim downloads this model
model = onnx.load("malicious_model.onnx", load_external_data=False)
#    ^ Bypasses path validation

# 2. Victim performs some operation and saves
onnx.save_model(model, "/home/victim/output.onnx")
#    ^ Triggers path traversal

# 3. Result: Arbitrary file overwrite
#    File written to: /home/victim/../../<attacker-controlled-path>

Impact

• Arbitrary File Write: Attacker can overwrite any file writable by the victim
• Remote Code Execution: Via SSH key injection, cron job injection, or shell rc files
• Privilege Escalation: Potential escalation in multi-user environments
• Supply Chain Risk: Malicious models in ML pipelines

Affected Scenarios

• ✅ Model sharing platforms (Hugging Face, GitHub)
• ✅ Model conversion services
• ✅ ML training pipelines with model optimization
• ✅ Jupyter Notebooks processing external models
• ✅ Automated CI/CD systems

Detection

Scan models with this script:

import onnx

def is_malicious(model_path):
    model = onnx.load(model_path, load_external_data=False)
    for tensor in get_all_tensors(model):
        for entry in tensor.external_data:
            if entry.key == "location" and ".." in entry.value:
                return True  # Path traversal detected
    return False

Remediation

For ONNX Maintainers

# Fix: Reuse the load-path validator in save path
def save_external_data(tensor, base_path):
    info = ExternalDataInfo(tensor)

    # Add validation before file write
    external_data_file_path = c_checker._resolve_external_data_location(
        base_path, info.location, tensor.name
    )
    # Now safe to write...

For Users

1. Always use load_external_data=True (enables validation)
2. Run onnx.checker.check_model() before saving
3. Only use models from trusted sources
4. Implement SHA256 verification
5. Sandbox untrusted model processing

Timeline

• 2025-12-15: Vulnerability discovered during security audit
• 2025-12-15: PoC created for responsible disclosure
• TBD: Vendor notification
• TBD: CVE assignment
• TBD: Public disclosure after patch

Ethical Disclosure

This PoC is shared with:

• ✅ Gated access control (manual review required)
• ✅ Clear warnings and documentation
• ✅ Safe payload (creates marker file only)
• ✅ Coordination with ProtectAI security team

DO NOT use this PoC against systems you don't own.

References

• Full security audit report: [Link to report]
• CWE-22: https://cwe.mitre.org/data/definitions/22.html
• ONNX GitHub: https://github.com/onnx/onnx

Contact

For security concerns: [Your responsible disclosure contact]

---

This model is part of responsible security research to improve ML ecosystem security.