| --- |
| license: mit |
| tags: |
| - surrealml |
| - onnx |
| --- |
| |
| # PoC: arbitrary file read when loading a .surml model |
|
|
| Proof of concept for a huntr model file vulnerability report. It is harmless: it reads a marker file you place in the working directory, to show the read primitive without touching real data. |
|
|
| Files: |
| - poc_exfil.surml — its ONNX initializer sets external_data.location=surml_poc_marker.txt, so loading the model reads that file and returns its bytes as output. |
| - control_benign.surml — same graph, inline weights, reads nothing. |
| - build_surml.py — rebuilds both and checks them. |
|
|
| Run: |
|
|
| pip install onnxruntime |
| python3 build_surml.py |
| |
| poc_exfil.surml output matches the marker file; the control reads nothing. The script also shows reading /etc/hostname (absolute path) and ../ traversal. |
| |
| A .surml from an untrusted source (e.g. an ml import upload) can read files readable by the loading process. Do not use against systems you do not own. |
| |
