metadata
license: mit
tags:
- surrealml
- onnx
PoC: arbitrary file read when loading a .surml model
Proof of concept for a huntr model file vulnerability report. It is harmless: it reads a marker file you place in the working directory, to show the read primitive without touching real data.
Files:
- poc_exfil.surml — its ONNX initializer sets external_data.location=surml_poc_marker.txt, so loading the model reads that file and returns its bytes as output.
- control_benign.surml — same graph, inline weights, reads nothing.
- build_surml.py — rebuilds both and checks them.
Run:
pip install onnxruntime
python3 build_surml.py
poc_exfil.surml output matches the marker file; the control reads nothing. The script also shows reading /etc/hostname (absolute path) and ../ traversal.
A .surml from an untrusted source (e.g. an ml import upload) can read files readable by the loading process. Do not use against systems you do not own.