# PoC — NeMo `setup_model()` target-allowlist bypass

`malicious_target_bypass.nemo` is an uncompressed tar archive (`tarfile.open(mode="w:")`, the
same mode NeMo itself uses to write `.nemo` files) containing:

- `model_config.yaml` — a minimal config whose top-level `target` field is
  `subprocess.Popen`, a class completely unrelated to any NeMo model and **not** present in
  `nemo.core.classes.common.ALLOWED_TARGET_PREFIXES`.
- `model_weights.ckpt` — a placeholder (not a real PyTorch checkpoint); it is never reached in
  this specific demonstration because `subprocess.Popen` has no `.restore_from()`.

## How this is meant to be used

```
python examples/asr/transcribe_speech.py model_path=malicious_target_bypass.nemo audio_dir=<any>
```

Expected effect, per the vulnerability described in the accompanying `SUBMISSION.md`:

1. `setup_model()` (`nemo/collections/asr/parts/utils/transcribe_utils.py:315-344`) calls
   `ASRModel.restore_from(restore_path=model_path, return_config=True)`, which extracts and
   parses `model_config.yaml` **without** ever calling `_is_target_allowed()` /
   `safe_instantiate()`.
2. `classpath = model_cfg.target` → `"subprocess.Popen"`.
3. `model_utils.import_class_by_path("subprocess.Popen")` succeeds — this is the raw,
   unprotected function; it imports `subprocess` and resolves `Popen` with no allowlist check
   at all.
4. `subprocess.Popen.restore_from(restore_path=..., map_location=...)` is then attempted and
   raises `AttributeError` (`Popen` has no `restore_from`), so the process crashes at this
   point.

The crash on step 4 is the **intentionally non-destructive, minimum-guaranteed** demonstration:
it proves the import of an arbitrary, attacker-chosen, out-of-allowlist class already happened
(step 3) before anything fails. Swapping `subprocess.Popen` for a module with dangerous
import-time side effects, or for a compatible internal NeMo model class, changes the outcome
without changing the underlying bug.

## Caveat — not run end-to-end against a live NeMo installation

The exact bypass mechanism (`import_class_by_path()` accepting `"subprocess.Popen"` while
`_is_target_allowed()` rejects it) **was** empirically verified by importing and calling the
real, unmodified functions from this commit's `nemo/utils/model_utils.py` and
`nemo/core/classes/common.py` directly (see `attachments/poc_allowlist_bypass.py` +
`attachments/run_output.txt` in the main submission folder).

What was **not** independently re-verified is running `transcribe_speech.py` end-to-end against
this exact `.nemo` file inside a full NeMo installation (setting up the complete pinned
dependency stack — `lightning`, `nv_one_logger*`, `megatron-core`, etc. — proved impractical in
the available verification environment due to unrelated third-party version incompatibilities
in the `nv_one_logger` / `lightning` integration layer, not to anything about this bug). The
static trace of `setup_model()` → `restore_from(..., return_config=True)` →
`load_config_and_state_dict()` (`nemo/core/connectors/save_restore_connector.py:98-202`) was
read in full and is quoted in the submission; only the live end-to-end run was not reproduced.

If it does not reproduce cleanly against a specific NeMo install, the standalone function-level
PoC remains valid, verified, independent evidence of the root-cause bug regardless.