sr64/poc-coreml-mlpackage-path-traversal

PoC: Path traversal in coremltools .mlpackage loader (CWE-22)

A crafted Core ML model package whose Manifest.json path field escapes the package Data/ directory.

• evil.mlpackage/Manifest.json — root item path set to ../../../../../../etc/hostname (a relative traversal escaping Data/). In ModelPackageImpl the value is joined to the package Data/ dir via std::filesystem::path::operator/ with no containment check (ModelPackage.cpp:308 validate, :466 findItem, :516 removeItem). operator/ resolves .. (and discards the base on an absolute path), so the resolved path leaves the package.

Reproduce (real compiled binding)

coreml_mlpackage_path_traversal_poc.py plants files outside a package and drives the real coremltools.libmodelpackage.ModelPackage binding. On Linux, coremltools 9.0:

pip install coremltools
python coreml_mlpackage_path_traversal_poc.py
# [A read ] opened OK; validate() exists()'d the traversed path -> escaped to ../../OUTSIDE/secret.txt
#           getRootModel path -> .../evil.mlpackage/Data/../../OUTSIDE/secret.txt  (outside Data/)
# [A ctrl ] non-existent external target -> "Item does not exist for identifier: ROOT"  (existence oracle)

(The Windows wheel omits the compiled libmodelpackage; run on Linux/macOS.)

Impact: out-of-package file resolution + host-path existence oracle on load; the same unsanitized path reaches std::remove() in removeItem()/replaceRootModel() (conditional file deletion when a consumer modifies the package).

Fix: reject path values that are absolute or contain .., and verify the joined path stays within the package Data/ directory (weakly_canonical + lexically_relative).