You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
Security proof-of-concept for a coordinated vulnerability disclosure (huntr Model File Vulnerability). Gated; access is for the huntr triage bot (protectai-bot). The embedded payload is benign (runs id, touches a marker file). Do not redistribute.
Log in or Sign Up to review the conditions and access this model content.
PoC: sktime vendored-Chronos eval(tokenizer_class) RCE via config.json
Security proof-of-concept for a coordinated disclosure (huntr Model File Vulnerability).
This is a copy of amazon/chronos-t5-tiny whose config.json -> chronos_config.tokenizer_class
has been replaced with a BENIGN payload that proves arbitrary code execution on model load.
Vulnerability
sktime/libs/chronos/chronos.py (ChronosConfig.create_tokenizer, line ~63) runs
class_ = eval(self.tokenizer_class) on a string taken verbatim from the model's config.json
(chronos_config.tokenizer_class). Loading via the public
sktime.forecasting.chronos.ChronosForecaster(model_path=...) API executes arbitrary Python.
Upstream amazon-science/chronos-forecasting uses getattr(chronos, self.tokenizer_class) and is
NOT affected; the eval() was introduced by sktime's vendoring.
- Affected:
sktime >= 0.34.0, <= 1.0.1(latest; no fix) - CWE-95 (Eval Injection) / CWE-94
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 (High)
Reproduce
pip install sktime torch transformers
python load_driver.py
# ChronosConfig.create_tokenizer() eval()'s tokenizer_class:
# runs `id` and creates /tmp/sktime_chronos_mfv_pwned (benign proof of code execution)
The malicious value is in config.json under chronos_config.tokenizer_class. The payload is
intentionally benign: subprocess.run(['/bin/sh','-c','id; touch /tmp/sktime_chronos_mfv_pwned']).
Fix
Replace eval(self.tokenizer_class) with getattr(chronos, self.tokenizer_class) (the upstream
approach) or an explicit importlib allowlist.
- Downloads last month
- 2