GHSA-3wqj-33cg-xc48: Rembg has a Path Traversal via Custom Model Loading
SummaryA **path traversal vulnerability** in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious `model_path` parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages.**CWE IDs:** CWE-22 (Path Traversal), CWE-73 (External Control of File Name or Path)DetailsVulnerable Code FlowThe vulnerability exists in how the HTTP server handles the `extras` JSON parameter for custom model types (`u2net_custom`, `dis_custom`, `ben_custom`).**1. Entry Point** - [`rembg/commands/s_command.py`](https://github.com/danielgatis/rembg/blob/main/rembg/commands/s_command.py#L191-L202)The `extras` parameter is parsed as JSON and passed directly to `new_session()` without any validation.**2. Path Handling** - [`rembg/sessions/u2net_custom.py`](https://github.com/danielgatis/rembg/blob/main/rembg/sessions/u2net_custom.py#L79-L83)The `model_path` is returned with tilde expansion but no validation against path traversal.**3. File Read** - [`rembg/sessions/base.py`](https://github.com/danielgatis/rembg/blob/main/rembg/sessions/base.py#L34-L38)The path is passed to `onnxruntime.InferenceSession()` which attempts to read and parse the file.Root CauseThe custom model feature was designed for **CLI usage** where users already have local filesystem access. However, this feature is also exposed via the **HTTP API** without any restrictions, creating a security boundary violation.PoCPrerequisitesPython 3.10+rembg installed with CLI support: `pip install "rembg[cpu,cli]"`Step 1: Start the Vulnerable ServerOpen a terminal and run:You should see output like:Step 2: Send the Exploit RequestOpen a **second terminal** and run this Python script:Or use **curl** directly:Step 3: Verify in Server LogsGo back to the **first terminal** where the server is running. You will see error messages like:Understanding the Results| Server Log Message | What It Proves |
|-------------------|----------------|
| `Load model from /etc/passwd failed:Protobuf parsing failed` | ✅ File **exists and was read** by onnxruntime |
| `Load model from /etc/shadow failed:Permission denied` | ✅ File **exists** but process lacks permission |
| `Load model from /nonexistent/... failed. File doesn't exist` | ✅ File **does not exist** - enables enumeration |**The key proof:** The message `"Load model from /etc/passwd failed:Protobuf parsing failed"` proves that:The attacker-controlled path was passed through without validation`onnxruntime.InferenceSession()` attempted to **read the file contents**The file was read but rejected because `/etc/passwd` is not a valid ONNX protobufImpactWho is Affected?**All users** running `rembg s` (HTTP server mode)**Cloud deployments** where rembg is exposed as an API service**Docker containers** running rembg serverAttack Scenarios**Information Disclosure**: Attacker enumerates sensitive files (`/etc/passwd`, `.env`, config files)**Credential Discovery**: Attacker checks for common credential files**Infrastructure Mapping**: Attacker discovers installed software and system configuration**Denial of Service**: Attacker attempts to load very large files, exhausting memoryWhat is NOT Affected?CLI usage (`rembg i`, `rembg p`) - users already have local file accessLibrary usage - developers control the inputRecommended FixOption 1: Disable Custom Models for HTTP API (Recommended)Remove custom model types from the HTTP API session list:Option 2: Validate model_path Against AllowlistIf custom models must be supported via HTTP:Option 3: Document Security ConsiderationsAt minimum, add security warnings to the documentation:References**CWE-22**: [Improper Limitation of a Pathname to a Restricted Directory](https://cwe.mitre.org/data/definitions/22.html)**CWE-73**: [External Control of File Name or Path](https://cwe.mitre.org/data/definitions/73.html)**OWASP Path Traversal**: [Path Traversal Attack](https://owasp.org/www-community/attacks/Path_Traversal)
CVSS v3.1: 5.3