| --- |
| license: mit |
| tags: |
| - security |
| - poc |
| --- |
| |
| # torch.package `module_allowed` security callback bypass -> RCE |
| |
| PoC for a huntr Model File Vulnerability (MFV) report against the **PyTorch Package (.pt)** |
| format (`torch.package`). This is a separate, distinct root cause from the earlier |
| `torch-package-interned-module-rce-poc` submission (interned-module `exec()`). |
| |
| ## The bug |
| |
| `PackageImporter.__init__` calls `module_allowed(extern_module)` for every name in |
| `self.extern_modules` (read from `.data/extern_modules` in the archive), and raises if |
| it returns `False`. This is the *only* documented trust-boundary parameter the API |
| offers -- the docstring says it exists so callers can "ensure packages loaded do not |
| depend on modules that the server does not support." |
| |
| Separately, `_load_module()`'s fallback path -- reached whenever the module tree lookup |
| misses -- checks a hardcoded `IMPLICIT_IMPORT_ALLOWLIST` (`numpy`, `numpy.core`, |
| `numpy.core._multiarray_umath`, `builtins`) and, if the name is on it, does |
| `importlib.import_module(name)` immediately. It never calls `module_allowed`. |
| |
| If an attacker crafts a `.pt` archive where `.data/extern_modules` simply doesn't |
| mention `builtins` (trivial -- just don't write that line, no need to go through the |
| real `PackageExporter` API at all for the final artifact), `module_allowed('builtins')` |
| is never invoked. `find_class('builtins', 'eval')` still resolves successfully through |
| the `IMPLICIT_IMPORT_ALLOWLIST` fallback. A developer who follows the docs and passes |
| `module_allowed=lambda m: False` to lock everything down is still fully exploitable. |
|
|
| ## Files |
|
|
| - `reproduce.py` -- full repro: builds a package with `Exploit.__reduce__` calling |
| `eval(...)`, strips `builtins` out of `.data/extern_modules`, then loads it through a |
| `PackageImporter` locked down with `module_allowed=lambda m: False`. Prints whether |
| `module_allowed` got called (it doesn't) and creates `/tmp/torch_package_builtins_bypass_pwned`. |
| - `build_payload.py` / `malicious_builtins_stripped.pt` -- the payload build script and |
| a pre-built copy of the malicious archive. |
| - `trigger_stripped.py` -- just the load-and-verify half of `reproduce.py`, against the |
| pre-built `.pt` file. |
|
|
| ## Reproduce |
|
|
| ```bash |
| pip install torch |
| python3 reproduce.py |
| ls -la /tmp/torch_package_builtins_bypass_pwned # created despite module_allowed=False |
| ``` |
|
|
| Full report: huntr.com MFV submission (PyTorch Package format). |
|
|
