aslein1413/poc-orbax-checkpoint-traversal

PoC — path traversal when restoring a JAX / Orbax checkpoint

An Orbax checkpoint is a directory (the standard JAX save format) with a plaintext _METADATA JSON. The victim calls Checkpointer(...).restore(path) with defaults. Orbax builds each leaf's on-disk path as os.path.join(ckpt_dir, name), where name comes from the attacker-controlled _METADATA. Relative .. is blocked by tensorstore, but absolute paths and Windows //host/share UNC paths are not.

Two primitives from a single default restore():

1. An absolute leaf name makes restore read a zarr store from an arbitrary location outside the checkpoint dir (cross-platform, shown in the script).
2. A //attacker/share/x name forces the victim host into an outbound SMB connection during the existence check, i.e. NTLM credential theft / SSRF (Windows-specific).

Files

• poc_orbax_traversal.py — self-contained: builds the checkpoints, tampers _METADATA, and demonstrates both primitives.
• NOTES.md — full write-up with the exact source locations.

Reproduce

pip install orbax-checkpoint numpy
python poc_orbax_traversal.py
# PRIMITIVE 1 -> TRAVERSAL-READ CONFIRMED (read outside ckpt dir)

Confirmed on a clean python:3.12-slim container with stock orbax-checkpoint 0.12.1.

Why it matters

A downloaded checkpoint can read files from outside its own directory on restore, and on Windows can coerce the host into authenticating to an attacker's SMB server. It is the default restore path with no misconfiguration. ModelScan does not recognize Orbax dirs.